ISO 27017 duration: how long does certification take?

The answer depends on the route you choose. The classic route is a project with several phases, each of which waits on the previous one. The Zertify route is a single assessment followed by a review.

The table sets both side by side. The figures for the classic route are indicative ranges. A company that already runs an ISO 27001 management system will land at the lower end, a company that starts from nothing at the upper end.

• What ISO certification costs

A certification body audits ISO 27017 on site. Your team has to prepare for that audit, and the preparation is where most of the calendar time goes.

1. 01

   Preparation and gap analysis

   You list your cloud services and compare your current practice with the controls of the standard. The result is a list of gaps: missing responsibilities, unclear tenant segregation, no defined data return.

2. 02

   Documentation and implementation

   You close the gaps. That means writing the cloud-specific risk analysis, fixing the split of tasks between you and your customers or providers, and setting up secure deletion and incident response for cloud events.

3. 03

   Stage 1 audit

   The auditor reviews your documents and checks whether you are ready for the full audit. Findings from this step must be corrected before the next one.

4. 04

   Stage 2 audit

   The auditor visits and checks that the documented measures work in practice. He speaks to administrators, looks at access rights and asks for evidence.

5. 05

   Report and certificate decision

   The certification body writes its report, you answer open points, and the body decides on the certificate. This step is often underestimated in project plans.

Two companies can start on the same day and finish months apart. Five factors explain most of the difference.

Existing ISO 27001 system

ISO 27017 extends ISO 27001 and ISO 27002. If risk analysis, access control and incident handling already exist, you add the cloud-specific parts instead of building from scratch.

Number of cloud services in scope

One SaaS product is quicker to document than IaaS, PaaS and a managed hosting offer together.

Clarity of shared responsibility

If your contracts already state who handles administrator access, backups and data return, the documentation phase shortens. If they do not, you need to negotiate and write that down first.

Findings after stage 1

Every open finding adds a correction loop. A second review of the same point can cost several weeks.

Capacity of your team

Documentation is usually done alongside daily operations. A small IT team spreads the work over more months than a dedicated project team.

Zertify replaces the project with an online self-assessment. You answer 34 yes/no questions on ISO 27017. Twelve of them are mandatory requirements of the standard and must all be answered yes. Of the remaining 22, at least 15 need a yes. Most people finish in about an hour.

Once you have passed and paid, SICE reviews your assessment. The certificate follows within 4 hours. G6 Agency AG issues it under licence from SICE, and no auditor visits your premises.

1. 01

   Answer the questions

   Start the assessment without registration. Have your cloud contracts and your list of administrator roles at hand.

2. 02

   Pass and pay

   The result is shown straight away. No account is needed to buy.

3. 03

   Receive the certificate

   You get a PDF with a certificate number and a QR code. Anyone can check both on the public verification page, for example a purchasing department that sent you a supplier questionnaire.

• How Zertify works
• Certification without an on-site audit

Zertify suits cloud providers and companies that use cloud services and need a certificate for a quote, a tender or a customer audit, with a deadline measured in days rather than quarters. The questions follow the central point of ISO 27017: who handles which security task, from tenant segregation to data return.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years and confirmed each year by that short re-audit. The subscription renews automatically and can be cancelled at any time in your customer account, to the end of the current year. If you hold two or three standards, a multi-standard discount of 20% or 30% applies, also on the yearly fee.

Some customers insist on an on-site audit by a certification body. Check the wording of your tender or supplier questionnaire before you choose a route.

• ISO 27017 at a glance
• Zertify pricing
• Compare the certification routes
• Start the free self-assessment