ISO 27017 online: certificate without an on-site audit

The whole route runs in the browser. You do not need an account to buy, and there is no appointment to coordinate with an auditor. Five steps lead from the first question to a certificate you can show a customer.

1. 01

   Start the self-assessment

   You answer 34 yes/no questions on the cloud security controls of ISO 27017. Starting is free and needs no registration.

2. 02

   Pass the assessment

   All 12 mandatory questions must be answered yes. Of the other 22 questions, at least 15 must also be yes.

3. 03

   Pay

   Payment is a yearly subscription. You can buy without creating an account.

4. 04

   Review and issue

   SICE reviews every assessment before the certificate is issued. G6 Agency AG then issues it under licence from SICE, within 4 hours after passing and payment.

5. 05

   Share and verify

   The PDF carries a certificate number and a QR code. Your customer scans it or enters the number on the public verification page.

• Start the free self-assessment
• See how it works in detail

The questions follow the logic of the standard: who is responsible for what in a cloud service, and how do you protect customer data. They are phrased so that you can answer yes or no from your own knowledge of your systems and contracts.

Some questions are mandatory requirements of the standard. A single no there means you do not pass, however well you score elsewhere. The remaining questions leave a little room.

Sit down with the person who runs your cloud environment, and with whoever signs your customer contracts. Most questions touch both technology and paperwork. Keep your service terms, your administrator access list and your incident procedure within reach.

The topics below come up repeatedly, so it pays to know your position on each before you begin.

Cloud-specific risk analysis

Have you assessed the risks that arise from running or using cloud services, not only those of your office IT?

Shared responsibility

Is it written down which security tasks you handle and which the cloud provider or the customer handles?

Tenant segregation

Can you show that one customer's data and workloads are isolated from another's?

Deletion of customer data

What happens to data when a customer leaves, and can you say how it is returned or securely deleted?

Virtualisation security

Are hypervisors, virtual machines and images configured and protected on purpose?

Cloud incident response

Do you know how you detect an incident, who tells the customer, and within what time?

The request usually arrives as a line in a supplier questionnaire, a tender or a customer audit: do you have evidence for your cloud security? Providers of IaaS, PaaS and SaaS hear it most. So do hosting providers, data centres, managed service providers and software companies with a cloud product.

Companies that mainly use cloud services can benefit too. A certificate shows your own purchasing department and your customers that you have thought through who is responsible for what.

• ISO for small and medium businesses

ISO 27017 extends ISO 27001 and ISO 27002 with controls for cloud services. You do not have to hold an ISO 27001 certificate to take the Zertify assessment for ISO 27017. If you do hold one, many answers will be familiar. The details of the standard are on its own page.

The certificate costs CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. It is valid for 3 years and confirmed each year by that short online re-audit. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein.

The subscription renews automatically. You can cancel at any time in your customer account, effective at the end of the current year, and the certificate then ends with the paid year. Combine standards and you get 20% off for two, 30% off for three or more, also on the yearly fee.

• ISO 27017 standard page
• Pricing
• Start the self-assessment

The classic route with an on-site audit by a certification body suits some situations. For a small team that needs a certificate for a tender, the effort is often the problem: dates, preparation days, an auditor in the server room or the office.

• Compare the certification routes
• Certification without an on-site audit
• What certification costs