ISO 27017 cloud security certificate: how to get one

An ISO 27017 cloud security certificate confirms that your organisation applies the cloud-specific security controls from ISO 27017:2015, whether you offer a cloud service or buy one. With Zertify you obtain it through an online self-assessment, without an on-site audit.

The rest of this article explains what the standard actually contains, who is asked for the certificate, and what to prepare before you start.

What ISO 27017 covers

ISO 27017:2015 is a code of practice for information security controls in cloud services. It builds on ISO 27002, the general catalogue of security controls, and adds guidance that applies only in a cloud setting. It does not have its own management system clauses 4 to 10. It tells you how to apply and extend controls, and it expects an information security approach to already exist around them.

The standard speaks to two parties at once. Cloud service providers get guidance on what they must secure and disclose. Cloud service customers get guidance on what they remain responsible for after moving data to someone else's platform. A software company that hosts its product on a public cloud and sells it to clients is both.

The seven additional cloud controls

Beyond the guidance added to existing controls, ISO 27017 introduces seven controls that do not exist in ISO 27002:

• Shared roles and responsibilities within a cloud computing environment
• Removal of cloud service customer assets when the contract ends
• Segregation in virtual computing environments
• Virtual machine hardening
• Administrator's operational security
• Monitoring of cloud services
• Alignment of security management for virtual and physical networks

Most questions in a supplier questionnaire map to one of these. "Who is responsible for patching the operating system?" is the first. "What happens to our data after we cancel?" is the second. "Can other tenants see our workloads?" is the third.

Who is asked for an ISO 27017 certificate

The request usually arrives from a purchasing department or a customer's security team. It appears in a tender, a vendor onboarding form or a renewal of a framework contract. A company that stores customer data in a cloud environment is asked to show that it handles that environment deliberately.

Typical holders of the certificate:

• SaaS vendors and software agencies that host client applications
• Managed service providers that run infrastructure for other companies
• Web and app agencies that operate client sites on cloud platforms
• Start-ups that sell to banks, insurers, healthcare or public bodies
• Consultancies and service firms that process client data in cloud tools

A company that only uses a cloud office suite and holds no sensitive client data will rarely need it. A company that hosts, processes or moves other people's data in the cloud will meet the question sooner or later.

Two routes to the certificate

The classic route is an on-site audit by a certification body. For ISO 27017, that audit is usually combined with an ISO 27001 audit, so you need a working information security management system first. That takes months and is built for organisations with a dedicated security function.

The second route is an online self-assessment. You answer structured questions about how your company handles cloud security, upload nothing you do not already have, and a reviewer checks the result. If you want to understand how this compares in detail, the guide on ISO certification without an audit sets out what changes and what stays the same.

The Zertify certificate is based on the online self-assessment, involves no on-site audit and is publicly verifiable. Which route fits depends on what the asking party accepts. Some tenders name a specific type of certification body, others ask only for evidence of a certified approach. Read the requirement before you choose.

What the certificate gives you in practice

The certificate is a PDF with a QR code. The QR code leads to a verification page where a buyer can confirm that the certificate exists, who holds it and how long it is valid. That matters more than the design of the PDF: a purchasing department that cannot verify a document tends to set it aside.

In practice you attach it to a quote, a tender response or a supplier questionnaire, and you point to the verification page where the questionnaire asks for proof. A customer audit becomes shorter when the basic cloud controls are already documented and confirmed.

Checklist before you start the assessment

The assessment asks how your company works. It does not ask you to invent processes. Gather the following first, and you will answer faster and more accurately.

• A list of the cloud services you use or provide, including hosting providers
• A clear statement of who is responsible for what between you and each provider
• A note on how customer data is separated between clients or tenants
• A description of how you handle contract end: export, deletion, confirmation to the customer
• The names of the people who hold administrator access, and how that access is approved
• How administrator actions are logged and who reviews the logs
• How virtual machines or containers are configured and hardened before use
• How you monitor your cloud services for unusual activity
• How virtual and physical networks are kept consistent in their security settings
• An existing information security policy, even a short one
• The name of the person who answers for security in your company

If several of these points are blank, that is useful information. The assessment will show where a control is missing, and you can close the gap before you submit.

Mistakes that delay the certificate

The most frequent problem is answering for the provider instead of for your own company. Your cloud provider may hold its own certifications. The assessment asks what you do on top of that, because responsibility under ISO 27017 is shared and the customer side does not disappear.

The second problem is vague answers about contract end. "We delete the data" is not a process. Who deletes it, within what period, and how is the customer informed?

The third is administrator access that nobody owns. Shared accounts and unlogged access are the weak spot a reviewer notices first.

How Zertify fits in

Zertify issues certificates based on an online self-assessment. The certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education). A member of the SICE Certification Board reviews every assessment before the certificate is issued. After a passed assessment and payment, the certificate follows within 4 hours.

The certificate is valid for three years. Each year you confirm it with a short online re-audit, which is part of a yearly subscription. Plan for that when you budget, and see the pricing page for the current figures.

The details of the standard, including scope and what the assessment covers, are on the ISO 27017 page. When your checklist is ready, you can start the assessment. It can be completed in one sitting if the information above is at hand, and you can leave and return if you need to ask a colleague.

What it costs and how to think about it

The classic route has fees for the audit, for preparation and often for outside consulting, and it takes time from your staff. The online route replaces most of that with the assessment and the subscription. For a general breakdown of what drives price in any ISO project, read the ISO certification cost guide.

Compare the price with the contract it unlocks. If a single tender depends on proof of cloud security, the question is whether the certificate meets that requirement, not whether it is the cheapest option on the market.

After you receive the certificate

Put the verification link into your standard quote template and your security page. Give your sales team the same link, so they do not send out old PDFs. Keep the records behind your answers: access lists, deletion procedures, monitoring settings. When the yearly re-audit comes, you update them instead of rebuilding them.

If you later add ISO 27001, the work you have done here carries over. The controls overlap, and the documentation you built for cloud security is a good first layer of the larger system.