ISO 27017 Cloud Security
ISO 27017 for financial services
Banks, insurers, asset managers and fintechs buy and sell cloud services every day, and their counterparties want to know who handles which security task. An ISO 27017 certificate answers that question in writing. With Zertify you complete an online self-assessment and receive the certificate within 4 hours of passing and payment.
01: Demand
Why do banks and insurers ask for ISO 27017?
A financial firm rarely runs everything on its own servers. Core banking, CRM, document archives, reporting tools and payment gateways often sit with cloud providers. Each of them holds data about clients and transactions, so the purchasing and risk departments send out supplier questionnaires.
General information security standards leave one question in those questionnaires only partly answered: in the cloud, who does what? ISO 27017 is built around it. It covers tenant segregation, administrator access at the provider, incident handling across both sides and the return or deletion of data when a contract ends.
If you sell software or hosting to financial institutions, the certificate gives the purchasing department a document to attach to your quote. They can check it on a public verification page instead of chasing you for evidence. If you are a financial firm that uses cloud services, it shows your own clients and partners that you have defined your side of the shared responsibility.
02: Risks
Which risks in financial services does ISO 27017 address?
The standard does not care whether you are a bank or a small advisory firm. It cares about where data sits and who can reach it. In financial services, these situations come up most often.
- Client files in a SaaS portfolio tool
- A wealth manager keeps client records and portfolio reports with a cloud provider. The standard asks that tenants are separated from each other and that you know which provider staff can access your data.
- Payment services on a PaaS
- A fintech runs its transaction processing on a platform provider. Patching, virtualisation security and logging are split between both parties, and the split is written down.
- Onboarding documents in cloud storage
- Scanned identity documents from client onboarding are stored in the cloud. When the client relationship or the provider contract ends, the data must be deleted securely and the deletion must be provable.
- Hosted claims and policy systems
- An insurer runs claims handling in a hosted system. The incident response plan names who informs whom, and in what order, when something goes wrong at the provider.
- Outsourced IT with administrator rights
- A managed service provider administers your cloud environment. Its access is limited to what the work requires, logged and reviewed.
03: Requirements
How does a financial firm meet the key requirements?
Most requirements ask for decisions that a financial firm already makes in some form. The work lies in making them specific to the cloud and writing them down.
| Requirement | Example in a financial firm |
|---|---|
| Cloud-specific risk analysis | A risk register lists each cloud service that holds client data, with the risk of provider outage, data exposure and loss of access. |
| Shared responsibility | A table per provider states who patches, who manages user rights, who keeps logs and who answers to the client. |
| Data isolation and tenant segregation | The provider confirms in writing how your data is separated from other tenants, and you check it during supplier review. |
| Secure deletion of customer data | The exit clause in the contract names the deletion method and requires a deletion confirmation at the end. |
| Virtualisation security | For virtual machines you operate yourself, hardened images and restricted hypervisor access are documented. |
| Cloud-specific incident response | The incident plan includes the provider's contact, a reporting deadline and the steps for informing affected clients. |
A supplier questionnaire from a bank will often ask for exactly these documents. Having them ready also helps in a customer audit.
04: Your role
Cloud provider or cloud customer: which side are you on?
ISO 27017 addresses both roles, and in financial services many firms hold both. A fintech that offers a client portal is a provider towards its clients and a customer of its own hosting company. The assessment asks you to describe your situation for each role you have.
Whether a certificate based on a self-assessment meets a particular tender or a particular institution's supplier rules is the decision of the party asking. Ask the purchasing department or the risk office early, before you start, and send them the verification page of an existing certificate if you have one.
05: Zertify
How do you get ISO 27017 with Zertify?
You work through an online self-assessment. There is no on-site audit and no consultant visit. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before the certificate is issued.
Answer 34 yes/no questions
The questions follow the requirements of ISO 27017 and take your role as provider, customer or both into account.
Meet the passing rule
12 of the questions are mandatory requirements of the standard and all must be answered yes. Of the other 22 questions, at least 15 need a yes.
Pay without an account
You do not need to register to buy the certificate.
Receive the certificate
It arrives within 4 hours after you pass and pay.
Share it with clients and partners
The PDF carries a QR code and a certificate number. Anyone can check both on the public verification page.
06: Price
What does the certificate cost, and how long is it valid?
The certificate costs CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. It is valid for 3 years, and each year a short online re-audit confirms it. Prices for customers in Switzerland and Liechtenstein include 8.1% Swiss VAT.
Billing runs as an automatic yearly subscription. You can cancel at any time in your customer account, to the end of the current year. If you cancel, the certificate ends with the paid year.
A firm that also wants ISO 27001 or ISO 27018 pays less per standard: 20% discount for 2 standards, 30% for 3 or more, applied to the yearly fee as well. The classic route with an on-site audit by a certification body costs more and takes longer, and the guide below compares both with indicative ranges.
07: FAQ
Questions about ISO 27017 for financial services
08: Guide
Related pages
Check your cloud security against ISO 27017
Answer 34 yes/no questions and see in a few minutes whether your firm passes.
Free and without registration.