Implementation walkthrough
How to implement ISO/IEC 27017: video walkthrough
A walkthrough of adding ISO/IEC 27017 cloud security controls to an information security management system, for cloud providers and the customers that use them.
Key takeaways
- ISO/IEC 27017 adds cloud guidance and cloud-only controls to an ISO/IEC 27001 ISMS.
- It applies to cloud service providers and cloud service customers.
- A responsibility matrix records who secures what.
- There is no stand-alone ISO/IEC 27017 certificate; it is assessed with ISO/IEC 27001.
- Existing certificate holders usually add it as a scope extension.
Cloud controls layered on ISO/IEC 27001
ISO/IEC 27017 is the international standard of information security controls for cloud services. It does not stand alone. It takes the controls of ISO/IEC 27002, the guidance catalogue behind ISO/IEC 27001, explains how each relevant one applies when a service is delivered or consumed through the cloud, and adds controls that exist only because of the cloud, such as agreeing who is responsible for what. It is written for both sides: the cloud service provider that operates the platform and the cloud service customer that puts its data and workloads on it.
No certificate exists for ISO/IEC 27017 on its own. The cloud controls are assessed with the ISO/IEC 27001 audit and recorded on the certificate scope or a supplementary certificate. This short film walks through how the controls are implemented.
Two routes, both through ISO/IEC 27001
Start by defining the cloud services, roles and scope: which services the organisation provides or consumes, on which deployment models, and whether it acts as provider, customer or both. A responsibility matrix then records what the provider secures and what the customer secures, which answers the question every enterprise buyer asks.
The cloud services enter the information security management system: the scope names them, the risk assessment covers them and the Statement of Applicability records the cloud controls as implemented. Cloud-specific guidance is applied to the relevant controls and the cloud-only controls are added, with records building up as the service runs. An organisation that already holds ISO/IEC 27001 adds the cloud controls and has them assessed, normally as a scope extension at the next surveillance or recertification audit or at a special visit; one that does not builds the ISMS and the cloud controls together for the two-stage initial audit. Either way, an independent body accredited for ISMS certification audits and decides.
Sterling's expert and experienced consultants design and implement the controls with your teams under Sterling OS™, with the evidence held in Effivity. The current edition is ISO/IEC 27017:2026, which replaced the 2015 edition and is built on ISO/IEC 27002:2022.
ISO/IEC 27017 at a glance
- Purpose
- Cloud-specific security controls and guidance for the organisations that provide cloud services and those that use them, layered on an ISO/IEC 27001 ISMS
- Relevant to
- SaaS, PaaS, IaaS, hosting and managed-service providers, and any organisation running client data or workloads in the cloud whose clients, tenders or regulators ask how cloud responsibilities are managed
- Edition
- ISO/IEC 27017:2026, second edition, published July 2026, replacing ISO/IEC 27017:2015; built on ISO/IEC 27002:2022
- Certification
- No certificate exists for ISO/IEC 27017 on its own: the cloud controls are assessed with the ISO/IEC 27001 audit by a certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1, and recorded on the certificate scope or a supplementary certificate
- Sterling's role
- Implementation with your team, the responsibility matrix, Effivity, training, vulnerability assessment, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for ISO/IEC 27017 cloud controls depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 2 to 4 months on an operating ISO/IEC 27001 ISMS, or 5 to 9 months when both are implemented together
ISO/IEC 27017: questions people ask
Can we be certified to ISO/IEC 27017 on its own?
No. ISO/IEC 27017 is a guidance standard of controls; it has no management-system requirements to certify against. Certification bodies assess the cloud controls as part of an ISO/IEC 27001 certification and record them on that certificate's scope or on a supplementary certificate. An "ISO 27017 certificate" with no ISO/IEC 27001 certification behind it is not accredited certification.
What changed with ISO/IEC 27017:2026, and is a certificate referencing the 2015 edition still valid?
The second edition, published in July 2026, replaces the 2015 edition and is built on ISO/IEC 27002:2022, so its cloud guidance follows the four control themes of the 2022 catalogue rather than the old numbering. Each certification body decides how and when the reference on a certificate moves to the new edition; ask yours for its timetable, and plan the re-mapping of your cloud controls and SoA for the next surveillance audit.
What is the difference between ISO/IEC 27017 and ISO/IEC 27018?
Both extend ISO/IEC 27002 for the cloud and both are assessed with ISO/IEC 27001. ISO/IEC 27017 covers information security for the provision and use of cloud services, for providers and customers. ISO/IEC 27018:2025 covers the protection of personally identifiable information by public cloud providers acting as PII processors. A provider that processes personal data for customers usually needs both; a customer normally needs ISO/IEC 27017 and looks to its providers for 27018.
Our provider is ISO/IEC 27017 certified. Does that cover us?
No. A provider's certificate covers the provider's management system and the controls it operates for the platform, not how you configure the service, manage identities and keys, monitor your tenancy or plan your exit. The major providers say so themselves: customers are not certified by association. Your own ISMS has to cover your side.
We only use cloud services; we do not provide any. Is ISO/IEC 27017 still relevant?
Yes. The standard is written for cloud service customers as much as providers, and applies to public, private and hybrid deployments. For a customer the value is a defined split of responsibilities with each provider, controls over your administrators, configuration, logging and exit, and a certificate that names the platforms you run on.
Keep exploring
Related to this video
The complete guide
Everything on ISO/IEC 27017
Start with the ISO/IEC 27017 page, or go straight to the guide you need.
On the ISO/IEC 27017 page
- What are the main ISO/IEC 27017 requirements?
- How do you get ISO/IEC 27017 certified?
- How much does ISO/IEC 27017 certification cost?
- How long does ISO/IEC 27017 certification take?
- Who needs ISO/IEC 27017 certification?
- How ISO/IEC 27017 makes cloud security provable
- Frequently asked questions about ISO/IEC 27017
Often combined with ISO/IEC 27017
More videos: Information security, cyber and cloud
- How to implement CMMC 2.0Implementation walkthrough · 3 min 15 s
- CMMC 2.0 requirements explainedTwo-minute brief · 2 min
- How to implement CSA STARImplementation walkthrough · 3 min 15 s
- CSA STAR requirements explainedTwo-minute brief · 2 min
- How to get Cyber Essentials certifiedImplementation walkthrough · 3 min 15 s
- Cyber Essentials requirements explainedTwo-minute brief · 2 min
- How to comply with the DESC Information Security Regulation (Dubai)Compliance walkthrough · 3 min 15 s
- DESC Information Security Regulation (Dubai) explainedTwo-minute brief · 2 min
- How to implement IEC 62443Implementation walkthrough · 3 min 15 s
Talk to a consultant
Plan your ISO/IEC 27017 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice