ISO 27017 renewal: how to keep your certificate valid

A Zertify certificate for ISO 27017:2015 is valid for 3 years. The term does not run on its own, though. Each year a short online re-audit confirms that your cloud security controls still match what you declared in the self-assessment.

The re-audit takes place online, like the first assessment. Nobody visits your office or your data centre. Every certificate can be checked publicly by number and QR code, so a customer who scans the PDF reaches the verification page directly.

Term

3 years from issue.

Yearly confirmation

A short online re-audit, once per year.

Cost of the re-audit

Included in the yearly fee.

Proof for third parties

Public verification page, reached by certificate number or QR code.

• ISO 27017 certificate

You complete the re-audit online, and it is shorter than the first assessment. It asks about the present state of your cloud environment, not the state a year ago.

If something changed during the year, the answers have to show it. A new hosting provider, a different administrator process or a customer contract that shifts duties all count. The standard is built around the question of who handles which security task, so the answers should follow the real split of work in your company.

An hour of review before the re-audit is usually enough if the controls are maintained during the year. Go through these six points. If you only use cloud services and do not provide them, apply the same list to the duties of your providers.

1. 01

   Cloud risk analysis

   Check that it still names the cloud services you run or use. A new region, a new SaaS tool or a retired platform changes the picture.

2. 02

   Shared responsibility

   Compare the written split of tasks with daily practice. Who patches, who manages backups, who approves administrator access? Update the document where a contract or a provider changed it.

3. 03

   Tenant segregation

   Confirm that customer data and environments are still separated after infrastructure changes, and that you can show how.

4. 04

   Deletion of customer data

   Check that the procedure for deleting and returning data of departing customers has been used or tested, and that backups are covered.

5. 05

   Virtualisation security

   Review access to hypervisors and images and list who holds administrator rights today. Remove the accounts of people who have left.

6. 06

   Incident response

   Look at the last incident or exercise. The procedure should cover cloud cases such as a compromised tenant and say how affected customers are informed.

The yearly confirmation is what keeps the certificate current. If the date passes without a completed re-audit, that year's confirmation is missing, even though the three-year term has not ended.

Treat a missed date as a gap in your evidence. A supplier questionnaire or a tender asks whether the certificate is current, and the purchasing department will open the verification page. The exact handling of a late re-audit is set out in the Zertify terms. In practice, complete it as soon as you notice.

Cancelling is a separate matter. The subscription renews automatically each year. You can cancel at any time in the customer account, effective at the end of the current year, and the certificate then ends with the paid year.

On the classic route with an on-site audit by a certification body, the certificate is checked in cycles. Between the initial certification and the end of the cycle the body returns for surveillance audits. At the end of the cycle, a recertification audit covers the whole management system again.

Zertify replaces these visits with one yearly online step. The table shows the difference in structure, not in scope of assessment.

• Compare the certification routes
• Certification without an on-site audit

The certificate is based on an online self-assessment with 34 yes/no questions. Twelve of them are mandatory requirements of the standard and must all be answered yes. Of the other 22, at least 15 need a yes. After you pass and pay, the certificate arrives within 4 hours. It is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. Customers in Switzerland and Liechtenstein pay prices that include 8.1% VAT. If you certify several standards, you get 20% off for two and 30% off for three or more, also on the yearly fee. You do not need an account to buy.

• Start the free self-assessment
• See pricing
• About ISO 27017