ISO/IEC 27017 requirements explained: video brief

No clauses of its own: an ISMS with cloud controls

ISO/IEC 27017 has no clauses 4 to 10 of its own. The management system it sits on is ISO/IEC 27001: context, leadership, risk assessment and treatment, the Statement of Applicability, internal audit and management review continue to apply, and they are what the certification body certifies. On that base the standard does two things, for the cloud service customer and the cloud service provider separately where their duties differ. This short film sets out both.

First, it gives cloud-specific guidance for the relevant controls of ISO/IEC 27002:2022, across the organisational, people, physical and technological themes. Second, it adds controls that exist only for cloud services, such as the shared roles and responsibilities between provider and customer. In the ISMS, the cloud services enter the scope, the risk assessment covers them and the Statement of Applicability records the cloud controls as implemented.

Who uses it, and how it is assessed

Cloud providers use it to show, through their ISO/IEC 27001 certificate, that their services run on controls designed for shared, multi-tenant environments, and to answer what they secure and what the customer must secure. Cloud customers use it to manage their own side of that responsibility when data and workloads move to the cloud. SaaS, PaaS, IaaS, hosting and managed-service providers are the usual adopters, along with organisations whose clients, tenders or regulators ask how cloud responsibilities are managed.

Assessment happens within the ISO/IEC 27001 audit, by a certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1, and the result is recorded on the certificate scope or a supplementary certificate. ISO/IEC 27017:2026, the second edition, was published in July 2026, replacing the 2015 edition.

The standard is written for cloud service customers as much as for providers, across public, private and hybrid deployments. A provider's certificate covers the provider's own management system and the controls it operates for its platform, not how a customer configures the service, manages identities and keys, monitors its tenancy or plans its exit; the customer's own ISMS has to cover those.