ISO 27017 for service companies

A service company rarely owns the servers that hold its customers' data. Your bookkeeping runs in a SaaS tool, project files sit in a shared drive, the ticketing system is hosted by a third party. Your customer knows this. In a tender or a supplier questionnaire the question is therefore not whether you use cloud services. It is who controls access, where the data goes and what happens to it when the contract ends.

ISO 27017:2015 gives you a recognised answer. It is a code of practice with security controls for cloud services and extends ISO 27001 and ISO 27002. It addresses cloud providers and cloud customers alike. That suits service companies, because most of them are both: they buy cloud services and they deliver their own services on top of them.

The people who ask are usually the purchasing department of a larger customer, an IT security officer reviewing a new supplier, or a partner who wants to connect your service to theirs. A certificate with a number and a QR code on the PDF saves them a round of follow-up questions.

• The ISO 27017 standard in detail

The central question of the standard is who handles which security task. These are the topics where service companies most often get asked, each with an example from daily work.

Shared responsibility

The split of security tasks between you, your cloud provider and your customer. An IT service provider writes down that it patches the customer's virtual servers while the hosting provider looks after the hypervisor.

Tenant segregation

Data of one customer stays apart from data of all others. An agency keeps each client's files in a separate project space with its own permissions.

Administrator access

Who may administer cloud systems and how that access is controlled. A managed service provider uses named admin accounts with multi-factor authentication instead of one shared login.

Data return and deletion

What happens to customer data when the contract ends. A consultancy hands back project data in an agreed format and confirms in writing that its own copies are deleted.

Virtualisation security

Protection of virtual machines and the environment they run in. A software company that runs customer test systems keeps them apart from production.

Cloud incident response

How incidents are detected, reported and handled when several parties are involved. A hosting reseller defines who informs the customer when the upstream provider reports a fault.

The requirements are the same for every company. What differs is the evidence you can show. The table lists the six key requirements and what they look like in a company that sells services.

The self-assessment has 34 yes/no questions. Twelve of them are mandatory requirements of the standard and must all be answered yes. Among the other 22, at least 15 need a yes. Five short preparations let you answer from facts instead of memory.

1. 01

   List your cloud services

   Write down every cloud service that touches customer data, whether you buy it or sell it.

2. 02

   Write the responsibility split

   For each service, note which tasks are yours, which belong to the provider and which to the customer.

3. 03

   Review administrator accounts

   Check who holds admin rights, remove shared logins and confirm that former staff have no access.

4. 04

   Define the exit

   Decide how customer data is returned and deleted when a contract ends, and who confirms it.

5. 05

   Name the incident contacts

   Record whom you call at your provider and whom you inform at the customer.

You answer the 34 questions online, without creating an account. If you pass, you pay and the certificate follows within 4 hours. It is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before the certificate is issued. There is no on-site audit. Each year a short online re-audit confirms the certificate.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription. You can cancel it at any time to the end of the current year in your customer account, and the certificate then ends with the paid year. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. If you certify several standards, you get 20% off for two and 30% off for three or more, also on the yearly fee.

Every certificate can be checked publicly by number and QR code. Your customer opens the verification page and sees the status without calling you.

• Start the free self-assessment
• See pricing
• How it works

Some customers and tenders prescribe the classic route with an on-site audit by a certification body. Others accept a publicly verifiable certificate based on a self-assessment. Read the supplier requirements or the tender documents before you decide, and ask the purchasing department if the wording is unclear.

The classic route means scheduling auditors and hosting an on-site visit. That takes more time and budget than an online self-assessment. The guides below compare the routes and the costs side by side.

• Compare the certification routes
• Certification without an on-site audit
• What certification costs