Customer due diligence
A recognised answer to cloud security questionnaires.
Implementation & guidance
ISO/IEC 27017 Cloud Security Controls
Code of practice · extension to ISO/IEC 27001
Guidance on information security controls for cloud services, for both cloud service providers and cloud service customers. It adds cloud-specific guidance to ISO/IEC 27002 controls and a set of additional cloud controls.
What the guidance covers
Cloud-specific security controls
ISO/IEC 27017 clarifies who is responsible for what in a cloud service, and adds controls that address risks particular to shared cloud environments.
Shared responsibility
Security roles split between provider and customer, documented and agreed.
Virtual environment segregation
Separation of customer environments on shared infrastructure.
Virtual machine hardening
Secure configuration of virtual machines to meet business needs.
Administrator operations
Controls on privileged cloud administration activities.
Customer monitoring
Customers able to monitor relevant aspects of the cloud service.
Asset removal
Customer assets returned or removed when the service ends.
Network alignment
Virtual and physical network security configured consistently.
Supplier relationships
Cloud security requirements in contracts and service agreements.
Why organisations implement it
What cloud control assurance delivers
Clear responsibilities
Fewer gaps between what the provider and the customer each secure.
Competitive tenders
Evidence buyers increasingly request for SaaS and cloud services.
Lower incident risk
Controls for the risks particular to multi-tenant platforms.
One audit programme
Assessed alongside your ISO/IEC 27001 certification.
Pairs with privacy
Combines with ISO/IEC 27018 for PII in public cloud.
How we work
Path to assessed cloud controls
One AEC methodology from first assessment to assessment, delivered by registered lead auditors.
- AssessGap assessment against ISO/IEC 27017, scope and roadmap
- DesignProcesses, risk register, policy and documented information
- ImplementProcesses embedded with coaching for process owners
- TrainAwareness for all staff and internal auditor development
- VerifyInternal audit, management review and mock certification audit
- Certify & sustainStage 1 and Stage 2 support, then surveillance readiness
Control extension
We add the controls to your existing ISMS and Statement of Applicability.
Typically 2 to 4 monthsCombined build
We build ISO/IEC 27001 and the additional controls together.
Typically 6 to 9 monthsReadiness review
We test your controls against customer or regulator expectations before an audit.
Typically 1 to 2 months
How it is recognised
Assessed as an extension of ISO/IEC 27001
ISO/IEC 27017 is a code of practice, not a standalone certifiable management system standard. Its controls are implemented within an ISO/IEC 27001 management system, and many accredited certification bodies assess them alongside the ISO/IEC 27001 audit, referencing ISO/IEC 27017 on the certificate or in a separate statement. AEC prepares you for that assessment; the decision is the certification body's.
Built on your ISMS
Controls added to your ISO/IEC 27001 risk treatment and Statement of Applicability.
Assessment-ready
Evidence organised so the certification body can assess the additional controls in the same audit.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Where it applies
ISO/IEC 27017 by industry
IT services · SaaS, PaaS and IaaS providers
Finance · cloud adoption under regulatory scrutiny
Healthcare · cloud-hosted clinical systems
Related standards
Questions
ISO/IEC 27017 FAQ
Can we be certified to ISO/IEC 27017 alone?
No. ISO/IEC 27017 is a code of practice. Its controls are implemented within an ISO/IEC 27001 ISMS, and many certification bodies assess them during the ISO/IEC 27001 audit and reference them on the certificate or in a statement.
Is it only for cloud providers?
No. It gives guidance to both cloud service providers and cloud service customers, so organisations relying on cloud services use it to define what they must secure themselves.
How does it relate to ISO/IEC 27018?
ISO/IEC 27017 covers cloud information security in general. ISO/IEC 27018 covers protection of personal data by public cloud processors. Many providers implement both.
Does AEC issue the certificate?
No. Certification and any reference to ISO/IEC 27017 are issued by an accredited certification body. AEC prepares your controls and evidence for that assessment.
Strengthen your cloud security controls
Tell us your cloud services, customers and current ISMS. We reply with a proposal covering control design, implementation and assessment readiness.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.