Your rating 0 from 0 votes
ISO/IEC 27017:2015 Information technology – Security techniques – Code of practice for information security controls based on ISO/IEC 27002 for cloud services
As businesses increasingly rely on cloud technologies, data protection has become a critical priority for every organization. While cloud services offer significant benefits, they also introduce risks related to safeguarding sensitive information. To address these risks and strengthen security in cloud environments, the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) developed the ISO/IEC 27017:2015 standard.
What is ISO/IEC 27017:2015?
ISO/IEC 27017 is an international standard jointly developed by ISO and IEC. It provides specific guidelines for managing information security within cloud environments. As part of the ISO/IEC 27000 family, it extends ISO/IEC 27002 by introducing additional controls and guidance tailored to cloud technologies.
The standard’s main goal is to support both cloud service providers and their customers in building secure, trustworthy, and well-managed environments for the exchange of data and services in the cloud.
It's important to note that ISO/IEC 27017 is not a certifiable standard on its own. Organizations cannot obtain independent certification solely for it. However, it plays a crucial role as a complement to ISO/IEC 27001. Implementing ISO/IEC 27017 within an integrated system with ISO/IEC 27001 significantly enhances the level of security in a cloud environment.
Why is ISO/IEC 27017 Important?
With the rapid evolution and widespread adoption of cloud technologies, effective information security management in cloud environments has never been more important. Cloud platforms often involve shared resources and virtualized systems, creating unique security risks and challenges. ISO/IEC 27017 provides practical controls to mitigate these risks while also helping organizations align with international compliance standards such as the GDPR.
Key Features of ISO/IEC 27017
ISO/IEC 27017 offers specialized guidance and controls for managing cloud security. Its key features include:
Who Should Use This Standard?
ISO/IEC 27017 is applicable to both cloud service providers and their clients. It is especially valuable for:
Benefits of Implementing ISO/IEC 27017
ISO/IEC 27017 and Related Standards
ISO/IEC 27017 is aligned with the harmonized structure of management system standards (Annex SL) and is designed to complement other key information security standards, including:
Want to Learn More?
If you're planning a cloud migration or already using cloud services and want to enhance your organization’s security and trust through ISO/IEC 27017, get in touch with us. We’ll help you transition to the cloud with greater transparency, security, and accountability.
What is ISO/IEC 27017:2015?
ISO/IEC 27017 is an international standard jointly developed by ISO and IEC. It provides specific guidelines for managing information security within cloud environments. As part of the ISO/IEC 27000 family, it extends ISO/IEC 27002 by introducing additional controls and guidance tailored to cloud technologies.
The standard’s main goal is to support both cloud service providers and their customers in building secure, trustworthy, and well-managed environments for the exchange of data and services in the cloud.
It's important to note that ISO/IEC 27017 is not a certifiable standard on its own. Organizations cannot obtain independent certification solely for it. However, it plays a crucial role as a complement to ISO/IEC 27001. Implementing ISO/IEC 27017 within an integrated system with ISO/IEC 27001 significantly enhances the level of security in a cloud environment.
Why is ISO/IEC 27017 Important?
With the rapid evolution and widespread adoption of cloud technologies, effective information security management in cloud environments has never been more important. Cloud platforms often involve shared resources and virtualized systems, creating unique security risks and challenges. ISO/IEC 27017 provides practical controls to mitigate these risks while also helping organizations align with international compliance standards such as the GDPR.
Key Features of ISO/IEC 27017
ISO/IEC 27017 offers specialized guidance and controls for managing cloud security. Its key features include:
1. Additional Controls and Guidance for Cloud Services
The standard enhances ISO/IEC 27002 by introducing cloud-specific practices. These include recommendations for cryptographic key management, monitoring of cloud activities, and protecting data stored in cloud systems.
2. Clearly Defined Roles and Responsibilities
To avoid confusion, the standard emphasizes the need to clearly define responsibilities between cloud service providers and customers. This includes tasks such as data protection, system configuration, and access to cloud resources.
3. Secure Management of Virtual Machines and Network Settings
Given the reliance on virtualization in cloud services, the standard offers guidance on securing virtual machines and protecting network infrastructure from unauthorized access and cyberattacks.
4. Access and Privilege Management
Strong control over access and user privileges is critical in cloud environments. ISO/IEC 27017 recommends mechanisms such as multi-factor authentication and continuous monitoring of user activity.
5. Secure Data Deletion
The standard provides best practices for securely deleting data from cloud platforms using verifiable and reliable methods—particularly during service termination or data migration.
6. Security-Focused Contracts and SLAs
To ensure long-term data protection, ISO/IEC 27017 encourages the inclusion of clear security clauses in contracts and Service Level Agreements (SLAs). This includes defining each party’s responsibilities and establishing explicit security requirements.
To avoid confusion, the standard emphasizes the need to clearly define responsibilities between cloud service providers and customers. This includes tasks such as data protection, system configuration, and access to cloud resources.
3. Secure Management of Virtual Machines and Network Settings
Given the reliance on virtualization in cloud services, the standard offers guidance on securing virtual machines and protecting network infrastructure from unauthorized access and cyberattacks.
4. Access and Privilege Management
Strong control over access and user privileges is critical in cloud environments. ISO/IEC 27017 recommends mechanisms such as multi-factor authentication and continuous monitoring of user activity.
5. Secure Data Deletion
The standard provides best practices for securely deleting data from cloud platforms using verifiable and reliable methods—particularly during service termination or data migration.
6. Security-Focused Contracts and SLAs
To ensure long-term data protection, ISO/IEC 27017 encourages the inclusion of clear security clauses in contracts and Service Level Agreements (SLAs). This includes defining each party’s responsibilities and establishing explicit security requirements.
Who Should Use This Standard?
ISO/IEC 27017 is applicable to both cloud service providers and their clients. It is especially valuable for:
- Cloud service providers (SaaS, PaaS, IaaS);
- Organizations storing or processing sensitive information in the cloud;
- IT teams managing cloud migration projects;
- Information security consultants and auditors.
Benefits of Implementing ISO/IEC 27017
- Enhanced Security – Identifies and addresses risks specific to cloud environments.
- Increased Trust – Demonstrates to clients and partners that their data is well protected.
- Clear Accountability – Encourages effective collaboration between providers and customers.
- Greater Contract Transparency – Supports well-defined terms in SLAs and other agreements.
ISO/IEC 27017 and Related Standards
ISO/IEC 27017 is aligned with the harmonized structure of management system standards (Annex SL) and is designed to complement other key information security standards, including:
- ISO/IEC 27001 – The foundational standard for establishing Information Security Management Systems (ISMS), outlining the requirements for implementation, maintenance, and continual improvement.
- ISO/IEC 27002 – Provides best practices and controls for information security, parts of which are expanded and adapted in ISO/IEC 27017 for cloud use.
- ISO/IEC 27018 – Focuses on protecting personally identifiable information (PII) in public clouds, and complements ISO/IEC 27017 with additional privacy-focused controls aligned with regulations like the GDPR.
Want to Learn More?
If you're planning a cloud migration or already using cloud services and want to enhance your organization’s security and trust through ISO/IEC 27017, get in touch with us. We’ll help you transition to the cloud with greater transparency, security, and accountability.
ISO/IEC 27017:2015 Information technology – Security techniques – Code of practice for information security controls based on ISO/IEC 27002 for cloud services
TAGS
News
12
10.26
NATO Quality Assurance Standards Gain Attention in Defence Industry Investment
NATO quality assurance requirements are of practical importance to Bulgarian com...
25
09.26
European Cybersecurity Month 2026: The Human Factor in Focus
Today, the Court of Justice of the European Union in Luxembourg is hosting the o...
Accents
06
11.26
AQAP-2110: Beyond ISO 9001 Requirements
What additional requirements apply to suppliers in the defence industry?
For ...
20
10.26
Change Management in the Food Sector: When Is a New Risk Assessment Necessary?
Changing a supplier may seem like a routine commercial decision, while extending...
Implementation of management standards
CONSEJO Ltd. is a consulting company with over 20 years of practical experience in the development, implementation and maintenance of management systems in accordance with international standards and regulatory requirements. The company provides consulting services in the areas of quality management, environmental management, occupational health and safety, food safety, information security, cybersecurity, risk management and sustainable development. Our expertise covers standards and schemes such as ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO/IEC 27001, IFS Food, BRCGS and HACCP, as well as consulting services related to NIS2, DORA, GDPR and EcoVadis.
The CONSEJO team has been involved in over 1,500 projects for organizations across various sectors of the economy, including manufacturing, construction, energy, information technology, transport, trade, the food industry and services. Our approach focuses on developing management systems that work effectively in practice, tailored to the specific characteristics and needs of each organization. We work closely with our clients, providing consulting support, staff training and assistance during implementation. We strive to deliver high-quality services within the agreed deadlines and solutions that support successful certification and create long-term value for businesses.
Partners
