ISO 27017 benefits for cloud providers and cloud users

ISO 27017:2015 is a code of practice with security controls for cloud services. It extends ISO 27001 and ISO 27002 and speaks to cloud providers and cloud customers alike. Its value comes from one thing: a documented answer to who is responsible for what.

1. 01

   Shorter supplier questionnaires

   Cloud questions repeat from customer to customer. A certificate with a number gives the purchasing department something to file instead of a new form to chase.

2. 02

   Evidence for quotes and tenders

   Where a tender asks for cloud security evidence, you attach the certificate and name the number.

3. 03

   Clear internal responsibilities

   Administrator access, tenant segregation and data return get an owner and a written rule.

4. 04

   Lower cloud risk

   The cloud-specific risk analysis and incident response procedure exist before the first incident, not after it.

5. 05

   A certificate others can check

   Every certificate has a number and a QR code that lead to a public verification page.

• ISO 27017 standard page

A customer who moves data into your software or hosting environment hands over control. The first questions are practical. Can another tenant see our data? Who at your company has administrator access? What happens to our data when we leave?

ISO 27017 is built around these questions. A certificate does not replace a conversation, but it moves the conversation forward. The customer's IT lead starts from a documented position instead of a blank questionnaire.

• ISO 27018 for personal data in the cloud

Some tenders and purchasing guidelines list cloud security evidence among their criteria. Read the tender document: if ISO 27017 or a comparable proof is named, the certificate goes into the appendix with its number.

Where no certificate is requested, it still has a use. It sits next to your answers in the security section of the quote, and the reviewer can verify it in a minute. In a customer audit, the shared responsibility documentation behind the certificate gives the auditor a clear starting point.

Check each tender for its exact wording. Some buyers require a particular type of audit, and then you need to know in advance which route they accept.

• Compare the certification routes

Most cloud providers already do much of this work. The difference is that it is written down, assigned to a person and checked once a year. Passing the self-assessment requires that you can say yes to the standard's mandatory requirements, and that alone sorts out a lot.

Responsibility matrix

Who configures, who monitors, who patches: provider and customer each know their side. Disputes after an incident become rarer.

Tenant segregation

You describe how customer environments are separated and who may cross the line. Support staff get clear rules.

Secure deletion

A defined procedure for returning and erasing customer data at the end of a contract replaces ad hoc handling.

Cloud incident response

Roles, contact paths and customer notification are fixed in advance.

Cloud risk analysis

Risks specific to virtualisation and shared infrastructure are assessed, not just general IT risks.

• ISO 27001 information security

The certificate PDF carries a QR code and a number. Both lead to a public verification page, so a prospect does not have to take your word for it. Put the verification link on your security or trust page, in the appendix of quotes and in the signature of your sales team.

Describe it accurately. The Zertify certificate rests on an online self-assessment without an on-site audit, and a short online re-audit confirms it every year. Buyers who read the verification page see exactly that, and a plain description holds up better than a vague claim of being audited.

• Certification without an on-site audit

The self-assessment for ISO 27017 has 34 yes/no questions. Twelve are mandatory requirements of the standard and must all be answered yes. Among the other 22, at least 15 yes answers are needed to pass. The certificate arrives within 4 hours after you have passed and paid.

It is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education), and SICE reviews every assessment before issue. The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. You can cancel in your customer account at any time to the end of the current year, and the certificate then ends with the paid year.

You need no account to buy. Holding two standards earns 20% off, three or more 30%, also on the yearly fee. Customers in Switzerland and Liechtenstein see prices including 8.1% VAT. If a customer insists on an on-site audit by a certification body, that is the classic route, and the guide below compares both.

• Start the free self-assessment
• Pricing
• ISO 27017 at Zertify