ISO/IEC 27017:2015
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
Standard Introduction
ISO/IEC 27017:2015 is an active standard published by International Organization for Standardization (ISO). It is commonly used across Technology, Services, Finance & Banking, Healthcare and applies in Global.
Use this page to review the official documentation, current status, and the certification or assessment bodies most commonly associated with ISO/IEC 27017:2015.
Cloud-Specific Controls
Provides 7 additional controls beyond ISO 27002, addressing shared responsibility, virtual machine hardening, customer asset removal, and virtual environment segregation.
Shared Responsibility Model
Clearly delineates security responsibilities between cloud service providers and cloud service customers — a critical distinction often misunderstood in cloud deployments.
Customer Monitoring
Requires cloud providers to enable customers to monitor relevant activities within their cloud environment, supporting transparency and compliance verification.
list_alt Key Control Areas
- Shared roles and responsibilities in cloud environments
- Virtual machine hardening and isolation requirements
- Customer asset removal upon contract termination
- Virtual environment segregation between tenants
- Cloud administrative operations procedures
- Customer activity monitoring capabilities
- Alignment of virtual and physical network security
- Guidance for both cloud service providers and customers
Who Needs to Comply?
Cloud service providers (IaaS, PaaS, SaaS) and organizations consuming cloud services that need to demonstrate robust cloud security controls. Especially relevant for technology companies, financial services, healthcare, and government agencies.
Key Requirements
Responsibility Delineation
Clearly define and document the division of information security responsibilities between the cloud service provider and the cloud service customer. Ensure both parties understand their respective obligations.
Virtual Environment Isolation
Implement controls to ensure adequate separation of virtual environments between different cloud service customers. Prevent unauthorized access across tenant boundaries.
Asset Management on Termination
Establish and communicate procedures for the return or secure deletion of customer assets, data, and configurations when a cloud service agreement ends or transitions to another provider.
Cloud Operations Security
Implement procedures for administrative operations specific to cloud computing environments, including monitoring of cloud resources, logging of cloud-specific events, and hardening of virtual machines.
Implementation Roadmap
Define cloud security roles
Identify cloud services, shared-responsibility boundaries, cloud service customer and provider obligations, tenants, platforms, regions, administrators, and dependencies on ISO/IEC 27001 and ISO/IEC 27002 controls.
Map cloud-specific controls
Assess current controls against ISO/IEC 27017 guidance for customer asset handling, virtual environment protection, administrator operations, tenant separation, monitoring, hardening, deletion, and provider-customer coordination.
Implement operational evidence
Update cloud policies, contracts, configuration baselines, IAM, logging, vulnerability management, incident response, change control, secure deletion, and customer responsibility documentation.
Integrate into ISMS assurance
Include cloud controls in ISO 27001 risk treatment, supplier reviews, internal audits, management reviews, service changes, new regions, and customer assurance packages.
Compliance Checklist
checklist Cloud scope
checklist Control implementation
checklist Assurance
Penalties & Enforcement
No direct legal penalties — ISO/IEC 27017 is a voluntary code of practice (not independently certifiable). However, it supplements ISO 27001 certification and is increasingly expected by enterprise customers and regulators evaluating cloud security posture.
Frequently Asked Questions
What does ISO/IEC 27017 cover?
expand_more
ISO/IEC 27017 provides cloud-specific implementation guidance and additional controls based on ISO/IEC 27002 for both cloud service providers and cloud service customers.
Can an organization be certified only to ISO 27017?
expand_more
ISO 27017 is usually used as an extension or assurance layer alongside an ISO 27001 information security management system rather than as a standalone management-system certification.
What is shared responsibility?
expand_more
Shared responsibility defines which security controls are handled by the cloud provider and which remain with the customer. ISO 27017 helps make those boundaries explicit through contracts, documentation, and operational controls.
Which controls are most cloud-specific?
expand_more
Typical focus areas include virtual environment protection, tenant separation, administrator operations, monitoring, customer asset return or deletion, cloud service configuration, and coordination between provider and customer.
How should customers use provider certifications?
expand_more
Provider certifications are useful assurance evidence, but customers still need to configure services securely, manage identities, classify data, monitor usage, and document their own responsibilities.
Official Documentation
Official PDF for ISO/IEC 27017:2015
Official publication or summary for ISO/IEC 27017:2015
Official online resource
International Organization for Standardization (ISO) guidance and reference material
Implementation toolkit
Templates, guidance, or companion resources for ISO/IEC 27017:2015