ISO 270177 min read
ISO 27017 vs ISO 27001: Differences and Which One You Need
ISO 27001 defines an information security management system. ISO 27017 adds security controls for cloud services. Here is where they differ and which fits you.
By Fabio Sestito, Managing Director SICE, expert and auditor for ISO 27001, 9001 and 20000-1
ISO 27001 sets the requirements for an information security management system (ISMS). ISO 27017 is a code of practice that adds security controls for cloud services, for the companies that provide them and the companies that use them.
The two standards do not compete. One describes how you manage information security as a whole. The other describes what good security looks like when your data or your product lives in the cloud.
The short answer
If you want a management system that covers your whole organisation, you look at ISO 27001. If your question is "how do we secure our cloud setup, and how do we show that to customers", you look at ISO 27017. Many companies end up with both, but they rarely start with both.
The practical difference shows up in the documents you are asked for. A supplier questionnaire that says "ISMS in place, certified to ISO 27001" is asking about management. A tender that says "cloud security controls according to ISO 27017" is asking about your cloud environment.
What ISO 27001 is
ISO 27001 is a management system standard. It follows the high level structure used by other ISO management standards: clause 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation and 10 Improvement.
These clauses are the requirements. You define the scope of your ISMS, assess information security risks, decide which controls you apply, run the system, review it and improve it. The controls themselves sit in Annex A, which in the 2022 edition lists 93 controls.
ISO 27001 does not care whether you run servers in a basement or everything at a hyperscaler. It asks that you know your risks and treat them in a documented, repeatable way. That is also why it is the standard behind most formal "we are ISO certified for information security" statements.
What ISO 27017 is
ISO 27017:2015 is titled as a code of practice for information security controls for cloud services. It is based on ISO/IEC 27002, the guidance document that explains the controls behind ISO 27001 Annex A.
It does two things. It gives cloud-specific implementation guidance for the existing controls, written separately for cloud service providers and for cloud service customers. And it adds a small set of extra controls that exist only because of the cloud model.
That split between provider and customer matters. A software company that offers a hosted product has different duties from a design agency that stores client files in a third-party cloud drive. ISO 27017 names both roles and describes who is responsible for what.
Where the two standards differ
| Aspect | ISO 27001 | ISO 27017 |
|---|---|---|
| Type | Requirements for a management system | Code of practice with guidance and controls |
| Scope | Information security across the organisation | Information security in cloud services |
| Structure | Clauses 4 to 10 plus Annex A | Guidance per control plus additional cloud controls |
| Audience | Any organisation | Cloud providers and cloud customers |
| Typical question it answers | "Do you manage information security systematically?" | "Is your cloud environment secured, and who is responsible for what?" |
A second difference is how people use them. ISO 27001 is the framework you build. ISO 27017 is the layer you apply once your services run in the cloud. Without some form of security management, ISO 27017 controls tend to turn into a list of settings nobody owns. Without ISO 27017 thinking, an ISMS can look complete on paper while the cloud tenant has shared admin accounts and no segregation between customers.
What the extra cloud controls cover
The additional controls in ISO 27017 deal with situations that do not exist in a classic on-premises setup. In plain terms they cover:
- Shared responsibility. Provider and customer agree in writing who handles which security task.
- Return and removal of customer assets. When a contract ends, the customer's data is returned or deleted in a defined way.
- Segregation in virtual environments. One customer's workload cannot reach another's.
- Hardening of virtual machines. Images and instances are configured to a secure baseline.
- Administrator operations. Actions by the people who run the cloud environment are controlled and documented.
- Monitoring of cloud services. Customers can see what is happening in their part of the service, and providers watch for misuse.
- Alignment of virtual and physical networks. Security settings in the virtual network match the physical one underneath.
If you have ever answered a customer question such as "how do you separate our data from other tenants" or "what happens to our data when we leave", you have already touched these topics.
Which one does your business need
Start from who is asking and what they ask for.
You offer a cloud product or hosting
Customers in procurement will want to know how tenants are separated, who has administrator access and how data is returned on exit. ISO 27017 answers those questions directly. If your customers are large enough to ask for an ISMS as well, ISO 27001 follows. Many providers also look at ISO 27018 when they handle personal data in the cloud, but that is a separate standard.
You mainly use cloud services
An agency, a consultancy or a small online shop is usually a cloud customer. Your risk sits in how you configure and govern other people's services: access rights, backups, offboarding of staff, choice of providers. ISO 27017 gives you a clear set of customer-side practices without asking you to build a full ISMS first.
You are a small team without a security officer
A full ISMS with risk register, internal audits and management reviews is real work. Our overview of ISO for small and medium businesses explains how smaller companies approach this in proportion to their size. Choosing the narrower, cloud-focused standard is a legitimate first step, as long as it matches what your customers ask.
A customer names a specific standard
Read the wording. "ISO 27001 certified" and "aligned with ISO 27017" are different requests. If the requirement is unclear, ask the purchasing department or the security contact which document they would accept. Some accept a certificate based on a self-assessment, others insist on an on-site audit. The route is explained in our guide to ISO certification without an audit.
Checklist: deciding between ISO 27017 and ISO 27001
How Zertify fits in
Zertify issues an ISO 27017 certificate based on an online self-assessment. There is no on-site audit. You answer questions about your cloud setup, roles and controls, and a member of the SICE Certification Board reviews every assessment before a certificate is issued. The certificate is issued by G6 Agency AG under licence from SICE.
After a passed assessment and payment, the certificate arrives within 4 hours. It carries a QR code that leads to a public verification page, so a buyer can check it without writing to you. It is valid for three years and is confirmed each year with a short online re-audit, which is part of a yearly subscription. Current prices are on the pricing page.
The alternative is the classic route with an on-site audit by a certification body. It takes longer and costs more in staff time, and some large customers specify it. If your customers do not, an online certificate for ISO 27017 covers the cloud question in your next questionnaire. You can begin the assessment when you have the checklist above filled in.
Common mistakes
Treating ISO 27017 as a replacement for ISO 27001. It is not. It covers cloud security, not the full management system. If a customer demands an ISMS certificate, a cloud-focused certificate will not answer that request.
Ignoring the customer side. Many small companies assume ISO 27017 is only for providers. It also describes what customers must do: choose providers carefully, configure services securely and plan their exit.
Writing policies without owners. A cloud security policy that no one is named to maintain loses value within months. Put a name next to every control.
Skipping the contract. Shared responsibility has to be written down. If your hosting agreement is silent on backups or data return, fix it before you claim the control.
Frequently asked questions
Is ISO 27017 part of ISO 27001?
No. They are separate standards. ISO 27001 sets requirements for an information security management system. ISO 27017 is a code of practice with guidance and extra controls for cloud services, based on ISO/IEC 27002.
Do I need ISO 27001 before ISO 27017?
No. ISO 27017 does not require an existing ISO 27001 certificate. Some customers ask for both, so check which one appears in your supplier questionnaires and tenders.
Is ISO 27017 only for cloud providers?
No. The standard gives guidance for cloud service providers and for cloud service customers. A company that only uses cloud services still has duties such as access control, provider selection and data return on exit.
Which standard do customers in procurement usually ask for?
It depends on the customer. Some ask for an ISMS under ISO 27001, others ask specifically about cloud security and name ISO 27017. Read the wording of the questionnaire or ask the contact person which evidence they accept.
Can I get an ISO 27017 certificate without an on-site audit?
Yes, through Zertify. The certificate is based on an online self-assessment, reviewed by a member of the SICE Certification Board and issued by G6 Agency AG under licence from SICE. If a customer insists on an on-site audit, the classic route with a certification body applies.
