ISO 27017:2015 Cloud Security
ISO 27017 requirements, clause by clause
ISO 27017:2015 adds cloud-specific security controls to ISO 27002. Its requirements settle who does what between provider and customer: tenant segregation, administrator access, monitoring, return and deletion of data. This page goes through them in plain language and says what you typically document.
01: Overview
What does ISO 27017 require?
ISO 27017:2015 is a code of practice. It takes the security controls of ISO 27002 and adds guidance for cloud services, written for the provider and for the customer. It extends ISO 27001, so the management system around it follows the same logic: risks, responsibilities, evidence.
The central question is allocation. Every security task needs an owner: the provider, the customer or both. If you run your CRM as a SaaS product, the provider patches the platform and you decide which employees get an account. Both sides of that split have to be written down.
The standard therefore concerns cloud providers (IaaS, PaaS, SaaS), hosting providers, managed service providers and software companies with cloud solutions. It equally concerns companies that buy cloud services and have to answer a supplier questionnaire about them.
02: Core requirements
The six requirements that matter most
Six topics carry the standard. Each one comes with evidence that a customer, a purchasing department or a reviewer will want to see.
- Cloud-specific risk analysis
- You assess risks that exist because of the cloud: shared infrastructure, provider access to your data, dependence on one vendor. Typically documented: a risk register with cloud entries and the decision taken for each.
- Shared responsibility
- Provider and customer agree who handles which security task. Typically documented: a responsibility matrix, backed by the contract or the service description.
- Data isolation and tenant segregation
- One customer's data and workloads must not be reachable by another customer. Typically documented: a description of the architecture and the results of segregation tests, or the provider's written statement on it.
- Secure deletion of customer data
- When a contract ends, the customer gets its data back and the provider deletes what remains. Typically documented: an exit procedure and a deletion confirmation.
- Virtualisation security
- Virtual machines and the layer beneath them are configured securely and kept patched. Typically documented: hardening baselines and patch records.
- Cloud-specific incident response
- Customers are told when an incident affects them, and both sides know who reports to whom and how fast. Typically documented: an incident procedure with contact points, notification times and an incident log.
03: Annex A
The seven cloud controls in Annex A
Annex A of ISO 27017 lists seven controls that exist only in this standard. They carry the prefix CLD and come on top of the controls of ISO 27002.
| Control | In plain language | Typically documented |
|---|---|---|
| CLD.6.3.1 Shared roles and responsibilities | Provider and customer record who does what. | Responsibility matrix, contract or service description |
| CLD.8.1.5 Removal of cloud service customer assets | Customer assets are returned and removed when the contract ends. | Exit procedure, deletion confirmation |
| CLD.9.5.1 Segregation in virtual computing environments | A customer's environment is separated from other tenants. | Architecture description, segregation tests |
| CLD.9.5.2 Virtual machine hardening | Virtual machines run only what is needed and are configured securely. | Hardening baselines, patch records |
| CLD.12.1.5 Administrator's operational security | Administrator work follows defined procedures. | Admin procedures, list of privileged accounts |
| CLD.12.4.5 Monitoring of cloud services | The provider monitors its service and the customer can monitor its own use. | Monitoring concept, log review records |
| CLD.13.1.4 Alignment of security management for virtual and physical networks | Virtual network settings match the policy for the physical network. | Network diagram, configuration policy |
The remaining guidance in the standard follows the clause structure of ISO 27002, clauses 5 to 18, and adds cloud advice to many controls there. Access control, cryptography, supplier relationships and incident management all appear in that form.
04: Management system
Which management system clauses apply?
ISO 27017 does not stand alone. It relies on the management system structure of ISO 27001, which uses the common clauses 4 to 10. In a cloud context they look like this.
Clause 4, Context
Define which cloud services you provide or use, and which customers, authorities and contracts set expectations.
Clause 5, Leadership
Management owns the policy and assigns the cloud security roles, on both the provider and the customer side.
Clause 6, Planning
Run the cloud risk analysis and set security objectives you can check.
Clause 7, Support
Provide staff, training and documented information, such as the responsibility matrix.
Clause 8, Operation
Run the controls day to day: segregation, administrator access, monitoring, deletion on exit.
Clause 9, Performance evaluation
Review logs, test results and incidents, and report them to management.
Clause 10, Improvement
Correct what the review found and record the change.
05: With Zertify
How to show these requirements with Zertify
Zertify checks your position with an online self-assessment of 34 yes/no questions for ISO 27017. Twelve of them are mandatory requirements of the standard and must all be answered yes. Of the other 22, at least 15 must be yes. There is no on-site audit.
G6 Agency AG issues the certificate under licence from SICE, and SICE reviews every assessment before it is issued. After you pass and pay, the PDF arrives within 4 hours. It carries a certificate number and a QR code that lead to a public verification page, which a customer can open during a tender or a customer audit.
The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein, and you need no account to buy.
06: FAQ
Questions about ISO 27017 requirements
07: Guide
Related pages
Check your ISO 27017 position today
Answer 34 yes/no questions and see whether your cloud security meets the requirements.
Free and without registration.