ISO 27017 consulting: when you need it and when you do not

No. ISO 27017:2015 is a code of practice with security controls for cloud services. It extends ISO 27001 and ISO 27002 and answers one question: who handles which security task, the cloud provider or the cloud customer. Tenant segregation, administrator access and the return of data are typical examples.

Whether you need outside help depends on one thing: can your team answer that question today? If someone already runs a risk analysis, maintains an information security policy and knows how customer data is deleted, the remaining work is mostly writing down what you do. If nobody has done this before, a consultant saves you months of trial and error.

Consulting projects follow a similar order. The exact content depends on whether you offer cloud services or only use them.

1. 01

   Gap analysis

   The consultant compares your cloud setup with the controls of the standard and lists what is missing or undocumented.

2. 02

   Cloud-specific risk analysis

   Risks such as shared infrastructure, provider outages or administrator access by third parties are assessed and rated.

3. 03

   Shared responsibility

   The split of tasks between you and your customers or providers is drafted, so that contracts and service descriptions say the same thing.

4. 04

   Policies and procedures

   Texts are written for data isolation, secure deletion of customer data, virtualisation security and cloud-specific incident response.

5. 05

   Training and internal review

   Staff are briefed, and the consultant runs a dry review before any external check.

Consulting in Switzerland is usually billed per day. A rate of CHF 1,200 to 2,000 per day is a reasonable indicative range, and the real figure varies with the consultant, the region and the depth of the project. The table below multiplies that range with typical effort. These are indicative ranges, not quotes.

• Certification cost explained

The decision is less about company size than about existing groundwork.

A consultant helps if

you run your own data centre or hosting platform, have no risk analysis yet, or need to restructure contracts with customers and sub-providers.

You can do without if

your team already knows the cloud setup, access rights and deletion process, and mainly needs a recognised certificate for a supplier questionnaire or a tender.

A combination works if

one gap, for example the incident response procedure, needs outside input. Book a few days for that topic and run the rest yourself.

• ISO for small and medium businesses

Zertify replaces the project with an online self-assessment. For ISO 27017 it has 34 yes/no questions. Twelve of them are mandatory requirements of the standard and must all be answered yes. Of the other 22 questions, at least 15 must be answered yes. A no is useful information: it shows which control you still have to put in place.

SICE reviews every assessment. The certificate is issued by G6 Agency AG under licence from SICE. There is no on-site audit. You do not need an account to buy.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. The yearly subscription renews automatically and can be cancelled at any time to the end of the current year in your customer account. After cancellation the certificate ends with the paid year. Customers in Switzerland and Liechtenstein pay prices including 8.1% VAT. If you certify two standards, you get 20% off, and 30% for three or more, also on the yearly fee.

• ISO 27017 certificate
• Pricing
• Start the free self-assessment

Every Zertify certificate carries a number and a QR code on the PDF. The QR code opens a public verification page. A purchasing department filling in a supplier questionnaire can check the certificate in a few seconds, without calling you.

Some tenders ask explicitly for a certificate from the classic route with an on-site audit by a certification body. Read the tender text before you choose. The guides below compare the routes.

• Compare the certification routes
• Certification without an on-site audit