The cloud model is becoming a go-to for companies to support day-to-day operations, develop apps, and store data, but it brings important questions about the responsibility of data security within cloud platforms. Companies often mistakenly believe that cloud service providers handle all security responsibilities, but in reality, most cloud security is a shared responsibility model, which is complex. Many companies are adopting cloud-specific security frameworks to distribute responsibilities and implement control mechanisms to mitigate risks.

ISO 27017 builds upon ISO 27001 and ISO 27002 by providing cloud-specific guidance for implementing and managing cloud security controls. It helps companies manage cloud-specific security risks.

In this article, I will explain what ISO 27017 is, the controls it introduces, and what companies can expect during implementation.

What Is ISO 27017?

ISO/IEC 27017 is a code of practice that outlines information security controls for cloud services. Developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), it offers cloud-specific guidance that builds upon the ISO/IEC 27001 and ISO/IEC 27002 standards.

Rather than replacing your existing ISMS, ISO 27017 enhances it with cloud-focused implementation advice. It addresses security challenges unique to cloud computing, like shared responsibility models, virtual infrastructure, and multi-tenant systems.

ISO 27017 is designed for both cloud service providers and their customers, which helps clarify security responsibilities for everyone involved.

Key Benefits of ISO 27017

Adopting ISO 27017 helps organizations strengthen their cloud security governance and risk management. Here’s how:

• Stronger Cloud Security: ISO 27017 offers structured guidance for identifying and mitigating cloud-specific risks, like configuration management, virtual asset protection, and access control.

• Clearer Responsibilities: The standard clarifies the shared responsibilities between cloud providers and their customers, reducing confusion over security ownership.

• Increased Customer Trust: Aligning with an internationally recognized standard demonstrates a commitment to managing cloud security risks effectively, which can boost customer confidence.

• Improved Risk Management: ISO 27017 helps you manage cloud assets throughout their entire lifecycle, from provisioning and operation to secure decommissioning.

What Is the Scope of ISO/IEC 27017?

ISO/IEC 27017 offers security guidelines to cloud service providers and customers. It covers areas of risk that are unique to cloud computing environments. These areas are:

• Cloud Security Governance: Set policies and procedures to establish and assign roles and responsibilities for the selection and ongoing oversight of cloud services.

• Virtual Infrastructure Security: Provides security for containers, networks, and virtual machines that supply cloud services.

• Data Segregation and Multi-Tenancy: Ensures that tenant data remains segregated and secure in a shared cloud environment.

• Cloud Service Lifecycle Controls: Security controls are applied throughout the cloud service lifecycle (including the establishment, configuration, operations, and secure disposal of the service).

Relationship With ISO 27001

ISO 27017 is intended to be used alongside ISO 27001, as it provides cloud-specific guidance rather than a standalone management system.

Here’s what ISO 27017 adds:

• More detailed information on the application of ISO 27002 to the cloud.

• Seven new controls designed for cloud protection.

• Revised cloud controls that expand the existing controls.

ISO 27017 takes the strong basis of ISO 27001 and adapts it to the specific needs of cloud computing.

Who Should Implement ISO 27017?

Your company may benefit from ISO 27017 if you store, process, or manage information in the cloud. This standard is relevant if you use cloud services or depend on them for important tasks.

Cloud Service Providers

For companies that provide cloud services, using ISO 27017 helps improve security management and shows that they follow recognized best practices for cloud security. The process includes:

• Software as a Service (SaaS) companies

• Managed service providers that provide cloud-based IT service

• Hosting providers offering infrastructure or platform services

• Platform as a Service (PaaS) providers

• Cloud-native application providers

Implementing ISO 27017 helps providers better define and manage customer expectations, increase customer trust, and improve cloud risk management quality.

Cloud Service Customers

Customers of Cloud Service Providers who use their services for critical and sensitive data benefit from ISO 27017 standards, such as

• Fintech companies that store data in the cloud.

• Healthcare services that house and manage sensitive patients' data.

• Enterprise SaaS providers are storing company data.

• Technology companies that own cloud-native applications.

• Companies with a multi-cloud or hybrid cloud infrastructure.

ISO 27017 guidance helps customers understand their security responsibilities on a shared cloud and enforce the required security measures.

When should you consider ISO 27017?

You may want to consider ISO 27017 if your company is:

• Managing sensitive customer information on the cloud.

• Working within a multi-cloud or hybrid cloud environment.

• Expanding cloud infrastructure on a rapid basis.

• Assisting enterprise customers or customers with specific regulatory requirements.

• Applying ISO 27001 to a cloud environment.

ISO 27017 is especially useful when your company heavily relies on cloud services.

ISO 27001 vs ISO 27017: What's the Difference?

Though ISO 27001 and ISO 27017 are closely related standards, they serve very different purposes. Understanding these two closely related standards will aid the implementation of cloud security in many companies.

ISO 27001 establishes requirements for an ISMS that would encompass all forms of information assets, whether physical, on-premises, or in the cloud.

ISO 27017 builds on this framework by providing specific cloud security guidelines. It does not replace ISO 27001 but provides support for companies using the security controls in cloud computing.

Key Differences Table

When You Need Both

Companies managing sensitive customer data in cloud environments often benefit from using both standards. Many cloud-native platforms, SaaS providers, and cloud service providers adopt both to strengthen security practices and meet customer expectations. Because ISO 27017 builds on ISO 27001, companies implement it either first or simultaneously. ISO 27017 guidance then becomes applicable to cloud-specific risks and controls.

ISO 27017 Cloud Security Controls Explained

The goal of ISO 27017 is to provide structured guidance for improving cloud security controls by providing specific security measures for cloud-specific architecture.

How ISO 27017 Controls Work

ISO 27017 uses a three-layer cloud security approach. It first incorporates existing controls from ISO/IEC 27002. Next, ISO 27017 supplements those existing controls with cloud-specific implementation guidance. Finally, ISO 27017 adds new controls aimed at addressing cloud-specific risks. This strategy helps companies with ISO 27001 compliance in broadening their security scope to include cloud-based environments easily.

List of ISO 27017 Unique Controls

ISO 27017 adds seven controls to specifically address the risks of cloud computing. Think of these as extra security steps tailored for the cloud.

1. Shared Roles and Responsibilities (CLD.6.3.1): This control addresses the concern about whether or not all the roles are defined. Each party, cloud customer, or cloud service provider, understands and appreciates their responsibilities. This eliminates uncertainty and creates accountability.

2. Removal and Return of Cloud Assets (CLD.8.1.5): Most cloud customers would like to know how their data is handled after they discontinue use of a cloud service. This control enables the customer to determine how to safely remove, return, or delete cloud data, cloud services, or cloud assets after the service expires.

3. Protection of Virtual Environments (CLD.9.5.1): In a shared cloud environment, it is necessary to ensure that each user has their own secured environment. This control is oriented towards the protection of virtual environments that are used, and it ensures that there is optimal logical separation of multiple users.

4. Virtual Machine Configuration (CLD.9.5.2): This control helps companies apply and maintain a secure system configuration, along with specific security measures or system hardening for virtual machines and their environments, to minimize system vulnerability.

5. Cloud Administrator Operations (CLD.12.1.5): This control provides certain management of cloud administrators who have high privileges. This section also covers basic security measures of high control that should be applied to access, management of the control, and authorization of access to the cloud environment.

6. Cloud Customer Monitoring (CLD.12.4.5): As a cloud customer, you need to see what is happening. This control allows you to access applicable security logs and monitoring details.

7. Virtual and Cloud Network Security (CLD.13.1.1): This control is about protecting virtual networks and consistently streamlining security throughout your cloud and on-premise environments to eliminate security gaps.

How ISO 27017 Certification Works

ISO 27017 is a code of practice, meaning it cannot be certified on its own. Companies typically implement it alongside ISO 27001 to extend their ISMS with cloud-specific controls. Certification bodies may evaluate your ISO 27017 practices during an ISO 27001 audit if the latter has cloud services in scope.

Step 1: Implement Foundation

Companies establish an ISMS aligned with ISO 27001, ensuring it includes policies, risk assessments, and security controls at a minimum. The ISO 27017 continues to expand those controls, now focusing on the specific risks associated with the cloud.

Step 2: Apply Cloud-Specific Controls

Companies must conduct a gap analysis, create a mapping to the cloud in which the controls apply, and then make the necessary adjustments to the Statement of Applicability (SoA) to address the cloud risks. Companies typically update the SoA to include ISO 27017 cloud-specific controls.

Step 3: Internal Audit

This step is where internal audits are meant to ensure that the controls specific to the cloud have been implemented and that the cloud security practices have been documented.

Step 4: Certification Audit

Your ISMS must go through some cloud controls (if applicable) as well as some that are non-cloud related, so an accredited certifying body must assess how those controls are working.

Step 5: Continuous Monitoring

A company will maintain all cloud security controls through continuous monitoring, periodic assessments, and annual reviews.

How Long Does ISO 27017 Certification Take?

The timeline to implement ISO 27017 controls varies depending on how established the company's ISO 27001 certification is. For example, if you already have an ISO 27001 certification, implementation timelines may be shorter when ISO 27001 is already established within your existing ISO 27001 certification scope. That is because implementing ISO 27017 would mean you only have to add more controls rather than build an entire ISMS from the beginning.

General timelines are the following:

• Small companies: 1 to 3 months

• Mid-size companies: 2 to 4 months

• Enterprises: 3 to 6 months

These are estimates and are subject to change based on your current ISMS, the complexity of your cloud infrastructure, and the status of your documentation.

Cost of Implementing ISO 27017 Controls

Since ISO 27017 lacks independent certification, the associated costs are added to the ISO 27001 certification costs, eliminating the need for a completely new audit. Companies are generally faced with costs associated with implementing ISO 27017 controls, the costs associated with calculating the gaps, and the costs associated with expanding the scope of the audit.

Key cost factors include the following:

• Company size: Larger companies have more complex systems that require a more thorough audit.

• Cloud infrastructure complexity: Multi-cloud or hybrid environments can increase audit time.

• Existing ISO 27001 maturity: Weak ISMS means that more implementation will be required.

• Certification body scope and audit duration: Different auditors will have different fees.

The possibility of having your audit costs go up slightly is likely because you are adopting ISO 27017 with ISO 27001. However, adopting both standards for the first time will likely involve more costs overall. Because the costs vary greatly depending on your particular situation, it is advisable to obtain estimates from different certification bodies.

Common ISO 27017 Implementation Challenges

Implementing ISO 27017 can present challenges, particularly for companies with complicated cloud systems. Understanding common obstacles in advance can help you organize your implementation better.

Shared Responsibility Confusion

Establishing responsibilities between cloud customers and cloud service providers is difficult. To clarify who is responsible for post-patch management, vulnerability management, and access control, you need to analyze service agreements and operational procedures.

Cloud Visibility Issues

This task is even more of a challenge for a company that uses multiple cloud providers, such as AWS, Azure, and Google Cloud.

Documentation Effort

Adapting controls and implementing ISO 27017 requires enough documentation of your cloud controls, architecture, and configuration. To gather evidence, you need the cooperation of several teams.

Continuous Monitoring Requirements

Companies typically implement continuous monitoring your cloud systems. This means you have to review your system’s logs, keep track of configuration changes, and deal with any risks that arise.

How Roz Supports ISO 27017 Engagements

Managing the documentation required for cloud compliance can be complex. Our tool helps with ISO 27017-related tasks by offering an organized, AI-driven space for cloud security checks and preparing for audits.

Think of Roz as an intelligent enterprise data room built for compliance-focused engagements. It helps advisory teams and CPA firms structure documentation and streamline the delivery of ISO 27017 audits.

Roz helps teams:

• Centralize cloud security documentation in secure, client-specific workspaces

• Organize cloud architecture diagrams and supporting documentation

• Assist with due-diligence questionnaires using source-linked documentation

• Generate draft workpapers with audit trails and traceability

• Highlight potential documentation gaps for comparison against ISO 27017 requirements

By structuring documentation and supporting first-pass analysis, we help teams maintain consistency while reducing time spent on manual audit preparation.

Conclusion

Cloud security should be a primary focus for a company in its cloud strategy. Utilizing ISO 27017 can adjust and improve the model's risk, responsibility, and overall governance.

Implementing ISO 27017 alongside ISO 27001 allows companies to address cloud-specific security risks using standard, accepted security measures.

I hope this article has provided a clear understanding of ISO 27017, its controls, and implementation considerations.