Is ISO 27017 mandatory for your cloud business?

ISO 27017:2015 is a code of practice with security controls for cloud services. No authority obliges a company to adopt it, and the standard itself does not require anyone to be certified. You decide whether to apply it.

Often the decision is made by someone else. A customer writes the standard into a supplier questionnaire, a purchasing department adds it to a framework contract, a tender lists it as a criterion. The certificate is then voluntary on paper and required in practice.

Be careful with claims that a specific law demands ISO 27017. Read the wording of the law or contract in question. A certificate can serve as evidence, but the document that sets the duty decides what counts as proof.

The pressure comes from the market, not from the standard. These are the situations in which a cloud provider or IT service company hears the question.

Customer questionnaires

Larger customers send security questionnaires to every cloud supplier. One question asks whether you hold ISO 27017. Without a certificate you answer in free text and wait for follow-up questions.

Supply chains

If you deliver software or hosting to a company that itself serves demanding customers, its requirements are passed down to you in the contract.

Tenders

Public and private tenders list certificates as selection or scoring criteria. A bid without the certificate can lose points or fall out of the process.

Cloud contracts

A contract for IaaS, PaaS or SaaS needs a clear split of tasks: who manages administrator access, tenant segregation, logging and the return of data. ISO 27017 gives both sides the same vocabulary for that split.

Industry expectations

When competitors show the certificate in their offers, the provider without it gets asked why.

The standard addresses cloud providers and cloud customers alike, so the question reaches both sides of a contract.

• ISO for small and medium businesses

A certificate alone answers little. The purchasing department or auditor wants to know that these topics are covered:

1. 01

   Cloud-specific risk analysis

   Risks are assessed for the cloud service, not only for the office IT.

2. 02

   Shared responsibility

   Provider and customer know which security tasks belong to whom.

3. 03

   Data isolation and tenant segregation

   One customer's data cannot be reached from another customer's environment.

4. 04

   Secure deletion

   Customer data is deleted reliably when the contract ends or on request.

5. 05

   Virtualisation security

   Virtual machines and their management layers are protected against misuse.

6. 06

   Cloud-specific incident response

   There is a defined way to detect, report and handle incidents that affect customers of the service.

Zertify issues the ISO 27017 certificate online, based on a self-assessment. There is no on-site audit. The assessment has 34 yes/no questions. 12 of them are mandatory requirements of the standard and must all be answered yes. Of the other 22, at least 15 need a yes.

Once you have passed and paid, the certificate follows within 4 hours. It is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before the certificate is issued. Every certificate has a number and a QR code that lead to a public verification page, so your customer can check it without asking you.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein.

Some customers want the classic route with an on-site audit by a certification body. The guide to the certification routes helps you compare both before you decide.

• ISO 27017 certificate at Zertify
• Pricing
• Compare the certification routes

A request with a deadline needs a short, ordered plan.

1. 01

   Read the exact request

   Check whether the customer names ISO 27017, ISO 27001 or only cloud security in general. Ask which form of proof they accept.

2. 02

   List your cloud tasks

   Note which services you operate, which you use, and who handles administrator access, segregation, logging and data return.

3. 03

   Take the self-assessment

   It is free and needs no registration. You see straight away whether you reach the required answers.

4. 04

   Pay and receive the certificate

   After passing and payment the PDF arrives within 4 hours. No account is needed to buy.

5. 05

   Send proof with the reply

   Attach the PDF to your questionnaire or quote and add the verification link or the QR code.

• Start the free self-assessment
• How it works
• Certification without an on-site audit