ISO 27017:2015 Cloud Security
ISO 27017 process: from self-assessment to verifiable certificate
You answer 34 yes/no questions online. SICE reviews your assessment, and G6 Agency AG issues the certificate within 4 hours after you have passed and paid. No auditor visits your premises and nobody has to find a date in a calendar.
01: Steps
The ISO 27017 process in six steps
The route is the same for a SaaS provider and for a company that runs its workloads at a cloud provider. Only your answers differ.
Start the self-assessment
Open it in the browser. It is free and needs no registration.
Answer 34 questions
Each question is a yes/no question about a control in your cloud environment. You can answer from the documents and knowledge you already have.
Reach the pass threshold
All 12 mandatory questions must be answered yes. Of the other 22 questions, at least 15 must be yes.
Order the certificate
Choose the certificate and pay online. You do not need an account to buy.
SICE reviews the assessment
SICE checks every assessment before a certificate is issued. G6 Agency AG then issues the certificate under licence from SICE.
Receive and share the certificate
You get a PDF with a certificate number and a QR code. Your customer scans the code or enters the number on the public verification page.
02: Questions
What the 34 questions ask about
ISO 27017 extends ISO 27001 and ISO 27002 with controls for cloud services. The central question is who handles which security task: you, your cloud provider or your customer. The questions follow the key requirements of the standard.
Have a few documents at hand before you begin. Typical examples are the contract or service description that splits responsibilities, the rules for administrator access, the deletion procedure for customer data and the incident procedure.
- Cloud-specific risk analysis
- Have you assessed the risks that come from running or using services in the cloud, not only those of your own office IT?
- Shared responsibility
- Is it written down which tasks lie with you and which with the provider or the customer?
- Data isolation and tenant segregation
- Is the data of one customer separated from the data of another, and can you show how?
- Secure deletion
- Is customer data deleted reliably when a contract ends or a customer asks for return and deletion?
- Virtualisation security
- Are virtual machines and the layers beneath them protected against misuse and cross-access?
- Cloud-specific incident response
- Do you know how an incident in a shared environment is reported, handled and communicated to affected customers?
A no on a mandatory question means you do not pass yet. Close the gap in your organisation first, then assess again.
03: Review
What happens after you submit the assessment
Once you have passed, the assessment goes to SICE for review. This is a check of your answers by a person at the institute, not an automatic stamp. After your payment is registered, G6 Agency AG issues the certificate.
Every certificate carries a unique number and a QR code. A purchasing department or an auditor at your customer can open the verification page, enter the number and see that the certificate exists and is valid. You can put the PDF into a tender, a quote or a supplier questionnaire and let the reader check it themselves.
04: Zertify
Where Zertify fits into your ISO 27017 project
Zertify issues the certificate on the basis of the online self-assessment. The first year costs CHF 799 (€799), then CHF 529 (€529) per year including the yearly online re-audit. Customers in Switzerland and Liechtenstein pay prices that include 8.1% Swiss VAT.
If you certify more than one standard, you get 20% off for two standards and 30% off for three or more. The discount also applies to the yearly fee. A company that already holds ISO 27001 often adds ISO 27017 as the second standard.
The standard page explains the requirements in more detail. The pricing page lists all conditions.
05: Comparison
ISO 27017 process with Zertify or the classic audit route
The classic route means an on-site audit by a certification body. It suits companies whose customers explicitly demand it. The table shows the practical differences. Durations and costs for the classic route vary by provider, company size and number of sites, so read them as indicative.
| Aspect | Zertify | Classic route with on-site audit |
|---|---|---|
| Method | Online self-assessment with 34 yes/no questions | Audit on site by a certification body |
| Time to certificate | 4 hours after passing and payment | Indicative: several weeks to a few months |
| Appointments | None, you answer when it suits you | Audit dates agreed with the auditor |
| Cost | Fixed first-year price and yearly fee | Individual quote, depends on size and sites |
| Proof for customers | Certificate number, QR code, public verification page | Certificate issued by the certification body |
| Yearly follow-up | Short online re-audit | Surveillance audit by the certification body |
06: Validity
How long the certificate is valid and what the yearly re-audit involves
The certificate is valid for 3 years. Each year you confirm your status in a short online re-audit, which is part of the yearly fee. You get the reminder in your customer account.
Billing runs as an automatic yearly subscription. You can cancel at any time in the customer account, effective at the end of the current year. If you cancel, the certificate ends with the year you have paid for.
07: FAQ
Questions about the ISO 27017 process
08: Guide
Related pages
Start the ISO 27017 self-assessment
Answer the 34 questions and see within minutes whether you reach the pass threshold.
Free and without registration.