ISO 27017 for IT companies

A supplier questionnaire from a larger customer almost always contains a block on cloud security. Who can access our data? Where is it stored? What happens to it when the contract ends? An IT company has to answer these questions in writing, often again for every new customer. ISO 27017 gives those answers a structure that buyers already recognise.

Purchasing departments that know ISO 27001 look for the cloud extension when a service runs in a shared environment. A certificate with a number and a QR code lets them tick that line in the tender without a follow-up call to your security officer.

Partners ask for it too. A managed service provider that builds your product into its own offer has to pass the same questions on to its customers. If your cloud controls are documented and certified, that chain of questions ends with you.

• ISO 27017 in detail

ISO 27017 extends ISO 27001 and ISO 27002 with controls for cloud services. It speaks to providers and to customers of cloud services. The risks below are the ones that come up in IT companies every week.

Tenant segregation

Several customers share one database cluster or one Kubernetes environment. Customer A must never see the records of customer B, and you must be able to show how that is enforced.

Administrator access

A support engineer needs access to a customer environment to fix a fault. Access is granted per ticket, logged and withdrawn when the ticket is closed.

Virtualisation security

Virtual machine images are hardened, hypervisors are patched on a fixed schedule, and snapshots are treated as customer data.

Data return and deletion

When a contract ends, the customer exports its data in an agreed format. Afterwards the data is deleted from production systems and from backups.

Cloud incident handling

A security incident in a shared platform affects several customers at once. The standard asks for a defined way to inform each affected customer.

Shared responsibility

Your customer runs its application on your platform, which runs on a hyperscaler. Each layer has an owner, and the split is written down.

The requirements are abstract on paper. In an IT company they translate into configuration, contracts and routines you probably have in part already.

Most IT companies can answer the questions faster if five things are on the table before they start.

1. 01

   Write down the responsibility split

   Take your standard customer contract and your cloud provider's terms. Mark which tasks sit with you, which with the customer and which with the provider.

2. 02

   Map where customer data lives

   List regions, storage services and backup locations. Include test and staging environments, because customer data often ends up there.

3. 03

   Review privileged accounts

   Check who holds administrator rights on production and how those rights are approved and logged.

4. 04

   Test one deletion

   Take a closed customer account and follow its data through production, backup and logs. Note where it still remains.

5. 05

   Name the incident contacts

   Decide who informs customers when something goes wrong, and keep a current contact list per customer.

The self-assessment for ISO 27017 has 34 yes/no questions. Twelve of them are mandatory requirements of the standard and must all be answered yes. Among the other 22 questions you need at least 15 yes answers. There is no on-site audit.

The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued. After you pass and pay, the certificate arrives within 4 hours. Every certificate can be verified publicly by its number and by the QR code on the PDF, so a customer's purchasing department can check it without asking you.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. The yearly subscription renews automatically and you can cancel it at any time in your customer account, effective at the end of the current year. The certificate then ends with the paid year. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. You do not need an account to buy.

If you also hold or plan ISO 27001, a second standard brings a 20% discount, including on the yearly fee. Three or more standards bring 30%.

• Start the free self-assessment
• See pricing
• Standard page ISO 27017

The classic route means an on-site audit by a certification body. It needs appointments, auditor time on your premises and a longer lead time. The Zertify certificate rests on an online self-assessment instead, reviewed by SICE and confirmed each year by a short online re-audit.

Some tenders name the route they accept. Read the wording of the requirement before you choose. If it asks for ISO 27017 evidence without specifying an on-site audit, a publicly verifiable certificate is usually what the buyer needs to see.

• Compare the certification routes
• Certification without an on-site audit
• What certification costs