ISO 27017 checklist: are you ready for certification?

ISO 27017:2015 is a code of practice with security controls for cloud services. It extends ISO 27001 and ISO 27002 and speaks to cloud providers and cloud customers alike. The central question is who handles which security task, from tenant segregation and administrator access to the return of data.

The checklist below follows the high level structure, clauses 4 to 10, and then covers the cloud controls in their own section. A point counts as met only if you can show something for it: a document, a record, a contract clause, a screenshot of a setting. A statement from memory does not count.

If you run a SaaS product, a hosting platform or managed services, most points apply to you as provider. If you mainly buy cloud services, the points on responsibilities, contracts and your own administrators carry the weight.

• ISO 27017 at a glance
• All standards

These points set the frame. They are mostly short documents, but they must exist and must be approved.

1. 01

   Define the scope and your role

   Write down which cloud services are covered and whether you act as provider, customer or both. Evidence: scope statement, service list, a simple architecture sketch.

2. 02

   List interested parties and their requirements

   Customers, hosting providers, sub-processors and authorities each expect something. Evidence: register of parties, relevant contract clauses, supplier questionnaires you have answered.

3. 03

   Adopt a security policy that mentions cloud

   Management approves it and staff can read it. Evidence: signed policy, approval date, intranet location.

4. 04

   Assign roles

   Someone owns cloud security and customers know whom to contact. Evidence: role description, organisation chart, contact address in the service description.

5. 05

   Carry out a cloud-specific risk analysis

   Cover risks such as data leaking between tenants, a provider outage or stolen administrator credentials. Evidence: risk register with owners, ratings and chosen measures.

6. 06

   Set security objectives

   Make them measurable, for example a deadline for critical patches. Evidence: objectives list with a review date.

• ISO for small and medium businesses

This is where an assessor sees whether the policy is lived. Records matter more than wording.

1. 01

   Train people with privileged access

   Administrators know the cloud setup and its risks. Evidence: training records, onboarding checklist.

2. 02

   Control your documents

   Procedures have an owner, a version and a review date. Evidence: document register, version history.

3. 03

   Write down the shared responsibility split

   For every security task it is clear whether you, your provider or your customer handles it. Evidence: responsibility matrix, service description, contract annex.

4. 04

   Run operations under change control

   Changes, backups and logging cover the cloud environment. Evidence: change tickets, backup logs, log retention settings.

5. 05

   Monitor and measure

   Someone looks at logs, alerts and the objectives from the planning stage. Evidence: monitoring reports, alert history.

6. 06

   Review internally and at management level

   Both reviews take place and produce decisions. Evidence: review report, minutes with actions.

7. 07

   Fix what went wrong

   After an incident or a finding you record the cause and the action. Evidence: incident log, corrective action list with closing dates.

These points go beyond a general information security checklist. Check each one against your own setup.

Tenant segregation

Customer data and workloads are separated, and you can explain how. Evidence: network and storage design, access rules, test results.

Administrator access

Privileged accounts are limited, protected with a second factor and logged. Evidence: account list, access review, authentication settings.

Virtualisation security

Hypervisors and images are hardened and patched. Evidence: hardening standard, patch records, image build process.

Deletion and return of data

You know how customer data is returned and securely deleted when a contract ends. Evidence: exit procedure, deletion confirmations, contract wording.

Cloud incident response

Customers are told about relevant incidents and you can reach them quickly. Evidence: incident procedure, notification template, exercise record.

The same standard reads differently depending on which side of the contract you sit on.

Once your evidence is in order, the self-assessment is quick to answer. It has 34 yes/no questions. Twelve are mandatory requirements of the standard and must all be answered yes. Among the other 22 questions you need at least 15 yes answers.

There is no on-site audit. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue. After you pass and pay, the certificate arrives within 4 hours. It carries a number and a QR code that lead to a public verification page, so a customer or purchasing department can check it themselves.

The price is CHF 799 in the first year, then CHF 529 per year including the yearly online re-audit. The certificate is valid for 3 years. If your customers insist on an on-site audit by a certification body, the guide on routes shows how the two compare.

• Start the free self-assessment
• See pricing
• Compare certification routes