ISO 27017 for SaaS companies: scope, controls and proof

ISO 27017:2015 is the international code of practice for information security in cloud services, and it applies directly to a SaaS company. Buyers ask for it in supplier questionnaires and tenders because it shows that you have settled who is responsible for what between your platform and their organisation.

This article explains what the standard covers, what a SaaS provider has to have in place, and how to end up with a certificate you can attach to a quote.

What ISO 27017 is

The standard is titled "Code of practice for information security controls based on ISO/IEC 27002 for cloud services". It takes the controls of ISO 27002 and adds guidance written for the cloud. The guidance has two audiences: the cloud service provider, which is you if you sell software as a service, and the cloud service customer, which is the company that buys it.

The standard also adds seven new controls that exist only for cloud environments. They deal with shared responsibilities, the return and removal of customer data, separation between customers on shared infrastructure, hardening of virtual machines, administrator operations, monitoring of the service and the alignment of virtual and physical networks. Everything else is existing ISO 27002 material with extra implementation advice for the cloud.

One point often causes confusion. ISO 27017 is a code of practice, not a management system standard like ISO 27001. It does not come with its own set of clauses 4 to 10. It tells you which controls to apply and how to read them in a cloud context.

Why SaaS buyers ask for it

A customer that moves its accounting, CRM or HR data into your platform hands over control of that data. The purchasing department and the IT lead still have to answer to their own management and their own customers. A supplier questionnaire is how they pass that duty on to you.

The questions are usually concrete. Where is the data stored? Who at your company can see it? What happens to it when the contract ends? How do you keep one customer's data away from another's? An ISO 27017 certificate answers most of these in one document, and the questionnaire can then shrink to the points that are specific to the deal.

For a start-up selling to mid-sized or large customers, this changes the sales cycle. A security review that took weeks of email can end with a link to a verification page.

The cloud topics the standard focuses on

A SaaS company does not need to read the standard clause by clause to understand what is expected. The content falls into a handful of themes.

Shared responsibility

You have to state what you secure and what the customer secures. You run the application, the infrastructure and the backups. The customer manages its users, its passwords and its own configuration of your product. If this split lives only in the heads of your founders, it does not meet the standard. It belongs in your terms, your documentation and your onboarding material.

Customer data at the end of the contract

The standard expects a defined process for returning and deleting customer data when a customer leaves. That includes the format of the export, the time frame and the confirmation of deletion. Backups need an answer too: when do they expire, and are they part of the deletion?

Separation between customers

If several customers share one database or one cluster, you must be able to explain how their data stays apart. This can be separate databases, tenant identifiers enforced in the application layer, or separate environments. The answer matters less than the fact that it is deliberate, documented and tested.

Virtual environments and administrators

Virtual machines and containers need a hardened baseline: unused services off, defaults changed, patches applied. Your own administrators are a risk as well. The standard asks for documented procedures, limited access and logs of what privileged users do.

Monitoring and visibility

You should monitor your service for misuse and for incidents, and be able to give customers the information they need about their own tenant. Many providers also use this point to define how they notify customers of a security incident.

What you need to have in place

Certification does not start with the certificate. It starts with the way your service is run on an ordinary Tuesday. Most SaaS companies already do a good share of this work without having written it down.

Use this list to see where you stand before you apply.

• A written description of the split of security responsibilities between you and your customers
• A list of your sub-processors and hosting locations, kept up to date
• A documented process for returning and deleting customer data at contract end
• A description of how customer tenants are separated from each other
• Hardening standards for servers, virtual machines and containers
• Role-based access for your own staff, with privileged access limited and logged
• Logging and monitoring of the production environment, with named owners
• An incident procedure that includes how and when customers are informed
• A change and release process that covers security testing
• Training for staff who have access to customer data

If you can tick most of these, you are close. Each gap you find is a finding for your own work, whatever certificate you pursue.

ISO 27017 and ISO 27001

The two standards work together. ISO 27001 defines the management system: scope, risk assessment, policies, internal review, continual improvement. ISO 27017 sharpens the control side for cloud services. Large customers often ask for both, and some accept 27017 on its own when a SaaS provider is small and the requirement is specific to cloud security.

If your buyers only mention "cloud security" in their questionnaires, 27017 is a reasonable first step. If they ask for an information security management system, you will need 27001 as well. Read the tender text before you decide, and ask the customer if it is unclear.

Routes to certification

The classic route with an on-site audit by a certification body takes time, needs staff to be available for interviews and can be a heavy load for a team of ten. For a start-up with an enterprise deal waiting, the timing is often the problem rather than the content.

A certificate based on an online self-assessment is a different route. There is no auditor on your premises, and you answer for the way your service is run. The guide on ISO certification without an audit explains what this means in practice and where each route fits. If you are unsure about the size of the task for a small team, the article on ISO certification for small and medium businesses gives the wider picture.

How Zertify fits in

Zertify issues an ISO 27017 certificate based on an online self-assessment. You answer the questions on the ISO 27017 page for your own service, and a member of the SICE Certification Board reviews the assessment before anything is issued. The certificate comes from G6 Agency AG under licence from SICE. It arrives within 4 hours after a passed assessment and payment.

The PDF carries a QR code that leads to a public verification page. A buyer's purchasing department can scan it, see that the certificate is valid and check the details without writing to you.

The certificate is valid for three years and is confirmed every year with a short online re-audit, which runs as a yearly subscription. The pricing page lists the current conditions. When you are ready, you can start the assessment and save your progress as you collect the facts about hosting, access and data deletion.

Mistakes SaaS companies make

Some patterns come up again and again.

• Mixing up the hosting provider's certificate with their own. Your cloud provider may hold certificates for its data centres. That covers their layer, not your application, your admin access or your deletion process.
• Describing the ideal, not the actual. An answer that reflects what you plan to do next quarter does not hold up in a customer audit. Describe what runs today.
• Forgetting the sub-processors. Support tools, analytics, email delivery and error tracking often see customer data. They belong on your list.
• Leaving the exit process undefined. Many providers can onboard a customer in a day but have never deleted one. Try the offboarding once before you claim it.
• Treating the certificate as the end. A buyer who reads the certificate may follow up with specific questions. Keep your documentation current so that you can answer them.

Presenting the certificate to buyers

Put the verification link in your security page, your tender answers and your standard quote. Name the standard and the version, ISO 27017:2015, and state clearly what the scope covers. If the certificate applies to one product and not to the whole company, say so. Customers react better to a precise scope than to a vague one.