ISO/IEC 27017 · Information security controls for cloud services
ISO/IEC 27017 certification consulting for cloud security your customers and your providers can rely on.
Add the ISO/IEC 27017 cloud controls to an ISO/IEC 27001 ISMS, or build both together, and have them assessed by an independent, accredited certification body so that your certificate names the cloud services your clients use. Sterling's expert and experienced consultants define who is responsible for what between you and your providers or customers, implement the controls, prepare the evidence and stay with you through the audit and the surveillance visits that follow, in 60+ countries. We ensure successful certification for our clients.
- One all-inclusive proposal for a defined scope: consulting, Effivity software, Sterling Academy access, vulnerability assessment and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced cloud security consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
8,100+ client engagements in 60+ countries.
ISO/IEC 27017 client experience
What it is
What is ISO/IEC 27017 and what is it used for?
ISO/IEC 27017 is the international standard of information security controls for cloud services. It does not stand alone: it takes the controls of ISO/IEC 27002, the guidance catalogue behind ISO/IEC 27001, says how each relevant one applies when a service is delivered or consumed through the cloud, and adds controls that exist only because of the cloud, such as agreeing who is responsible for what. Published jointly by ISO and IEC, it is written for both sides: the cloud service provider that operates the platform and the cloud service customer that puts its data and workloads on it.
It is used in two ways. A provider uses it to show, through its ISO/IEC 27001 certificate, that its service runs on controls designed for shared, multi-tenant environments, and to answer the question every enterprise buyer asks: what do you secure, and what is left to us? A customer uses it to decide, document and audit its own side of that split, so that a certificate reading "ISO/IEC 27001" covers the platforms the business runs on, not only the office network. There is no certificate to ISO/IEC 27017 by itself; the controls are assessed within the ISO/IEC 27001 certification.
Current edition. ISO/IEC 27017:2026, the second edition, was published in July 2026 and replaced ISO/IEC 27017:2015, which is withdrawn. The new edition is built on ISO/IEC 27002:2022, so its cloud guidance follows the four control themes of the 2022 catalogue and, through Annex A of ISO/IEC 27001:2022, the SoA you already maintain. There is no transition scheme for a guidance standard: certification bodies decide how and when a certificate that references the 2015 edition is updated to the 2026 text, so ask yours before the next surveillance audit.
Who it is for
Who needs ISO/IEC 27017 certification?
ISO/IEC 27017 is for any organisation whose security depends on a cloud relationship, which is most organisations. The demand is sharpest for companies that sell cloud services and are asked to prove them, and for regulated or enterprise customers that must show they manage the half of cloud security their provider does not. Four situations bring organisations to Sterling:
- An enterprise client asks whether your ISO/IEC 27001 certificate covers your cloud service. A certificate scoped to the offices says nothing about the SaaS platform the client is procuring. Adding the ISO/IEC 27017 controls and the service to the scope answers the question on the certificate.
- Tenders and security questionnaires list ISO/IEC 27017 and 27018 beside ISO/IEC 27001. Public-sector, financial-services and healthcare buyers increasingly name the cloud standards for hosted services. Confirm what the tender requires: edition, service, accreditation, and whether 27018 or SOC 2 is asked for too.
- You run client data on public cloud and nobody has written down who secures what. The provider's certificate covers the platform, not your configuration, identities, keys, logging or exit plan. ISO/IEC 27017 gives the customer side a control set.
- A regulator, insurer or board wants the cloud dependency governed. Provider concentration, data location and the ability to leave a service are board questions now. The standard turns them into documented controls with owners and evidence.
Business benefits
How ISO/IEC 27017 makes cloud security provable
The controls are worth implementing for what they settle: which party does what, what happens at the end of the contract, and whether anyone would notice an administrator doing something they should not. The certificate shows it.
- One agreed split of responsibilitiesCustomer and provider duties written down, control by control, so nothing falls into the gap between "we assumed you did that" and "so did we".
- A certificate that names the cloud serviceScope wording that covers the platform your clients use, with the cloud controls recorded, so due diligence is answered from the certificate.
- Tenders you can qualify forThe ISO/IEC 27017 line in a tender met with an accredited certificate, not a self-declaration.
- Fewer surprises at exitData return, deletion and the removal of your assets agreed before you need them.
- Control over privileged cloud operationsAdministrator activity defined, logged and reviewed, and virtual environments separated so one tenant cannot see another.
- The base for 27018, SOC 2 and CSA STARThe same risk register, control set and evidence extend to ISO/IEC 27018, SOC 2 and CSA STAR when clients ask.
Requirements
What are the main ISO/IEC 27017 requirements?
ISO/IEC 27017 has no clauses 4 to 10 of its own. The management system it sits on is ISO/IEC 27001: context, leadership, risk assessment and treatment, the SoA, internal audit and management review continue to apply, and they are what the certification body certifies. On that base the standard does two things, for the cloud service customer and the cloud service provider separately where their duties differ: it gives cloud-specific guidance for the relevant controls of ISO/IEC 27002:2022, and it adds controls that exist only for cloud services. The tables are a plain-language map; the programme works from the standard's own text.
| Part of the system | Where the cloud changes it | What it looks like in practice |
|---|---|---|
| ISMS ISO/IEC 27001 clauses 4 to 10 | The cloud services enter the ISMS: the scope names them, the risk assessment covers them, the SoA records the cloud controls | A scope that names the platforms and services; cloud risks with owners; an SoA showing the cloud controls as implemented |
| Organisational controls, ISO/IEC 27002:2022 theme 5 | Policies, roles, supplier arrangements, incidents and legal requirements run across two organisations: what the customer requires, what the provider commits to, and how changes and incidents are handled between them | A cloud service agreement checklist, a supplier assessment per provider, incident contacts, legal and data-location registers |
| People controls, theme 6 | Administrators and users hold more power in a browser than a server room gave them, and leavers keep it until every tenant is checked | Administrators trained, access tied to role; users taught what not to store or share; leavers removed from every tenant |
| Physical controls, theme 7 | The customer's data lives in facilities it will never visit, so physical protection becomes something the provider evidences and the customer verifies | Data-centre attestations on file against the services that depend on them; your own sites covered as before |
| Technological controls, theme 8 | Access, cryptography, logging, backup, configuration and network controls run on shared infrastructure, partly in the provider's hands and partly in yours | Key-management decisions written down; tenant logs available; backups tested; hardened images and baselines |
Controls that exist only for the cloud: the seven topics introduced in 2015
The 2026 edition keeps a set of additional cloud-specific controls on the ISO/IEC 27002:2022 structure; the seven topics below were introduced by the first edition and are the questions any cloud programme has to answer.
| Topic | The customer side | The provider side |
|---|---|---|
| 1 Shared roles and responsibilities | Decide and record what you secure and what you rely on the provider for, and agree it | Publish what the service does and does not take on |
| 2 Removal and return of assets at the end of the contract | Know how your data comes back, and when it is deleted | Define and evidence return and deletion for every customer |
| 3 Separation of customers' virtual environments | Ask how your tenancy is isolated and what evidences it | Enforce and monitor isolation between tenants |
| 4 Virtual machine configuration | Harden the images and instances you control: baselines, patching | Provide secure defaults and guidance for the images offered |
| 5 Administrator operations in the cloud environment | Define, restrict and log privileged operations by your administrators | Document, control and log what administrators do |
| 6 Customer monitoring of activity in the cloud | Use the monitoring the service exposes; know what you cannot see | Give customers the means to monitor their tenancy |
| 7 Alignment of virtual and physical network security | Apply the same segmentation and policy to virtual networks as to physical | Keep virtual and physical network security consistent |
What does useful ISO/IEC 27017 evidence look like?
A responsibility matrix agreed with each provider or published to each customer; cloud services named in the scope and risk register; an SoA that shows the cloud controls with justification and status; supplier assessments and the agreements they rest on; the exit and data-return plan; privileged-access reviews and logs; configuration baselines and proof they are applied; tenant-level monitoring reports; and internal audit findings on the cloud controls. The records live in Effivity from the first workshop, so the auditor sees cloud controls that operate.
ISO/IEC 27017 controls explainedCertification process
How do you get ISO/IEC 27017 certified?
The route runs through ISO/IEC 27001. If you hold a certificate, the cloud controls are added to the ISMS and assessed by your certification body, normally as a scope extension at the next surveillance or recertification audit or at a special visit; if you do not, the ISMS and the cloud controls are built together and certified in the two-stage initial audit. Either way an independent body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1 audits and decides; Sterling consults, designs and prepares.
- 01Define the cloud services, roles and scope.Which services you provide or consume, on which deployment models, where you are customer and where provider, and how the certificate scope must read for the client or tender behind it.
- 02Gap analysis: measure the ISMS and its cloud controls against ISO/IEC 27017:2026.The gap analysis compares your scope, risk assessment, SoA, supplier arrangements and technical controls with the 2026 text, keeps what works and sets the action plan.
- 03Agree responsibilities, extend the risk assessment and implement.The responsibility matrix per provider or customer, cloud risks added to the register, the SoA extended, then configuration, access, logging, monitoring and exit arrangements put into operation, with the vulnerability assessment of the environments you control.
- 04Audit internally, review and close the findings.Internal audit across the ISMS clauses and the cloud controls, then management review; we raise the findings first and close them with evidence before the certification body arrives.
- 05Pass the independent assessment.For a new ISMS, the certification body's Stage 1 readiness review and Stage 2 audit; for an existing certificate, the extension audit it schedules. Respond to any findings and await its decision.
- 06Keep the cloud controls running after certification.Provider reviews, privileged-access reviews, configuration checks, monitoring and exit-plan tests continue, alongside annual surveillance audits and recertification.
Check the route, not only the fee. Ask which body will assess the cloud controls, under which accreditation, how the result will appear on the certificate and how many audit days it adds, then confirm each answer with that body. Treat an "ISO 27017 certificate" with no ISO/IEC 27001 certification behind it as a warning: the cloud controls are certified through the ISMS, not instead of it. How to choose a credible ISO/IEC 27017 provider · The certification buyer's checklist
Cost
How much does ISO/IEC 27017 certification cost?
Adding cloud controls to a working ISMS is a smaller programme than building an ISMS; building both together is an ISO/IEC 27001 programme with a cloud dimension from day one. The number of providers or services, the deployment models and how much of the responsibility split is already documented drive the effort. Sterling commits to a proposal with every component visible and a fee that does not move.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Whether an ISO/IEC 27001 ISMS exists, the number of cloud services and providers in scope, the state of supplier arrangements and technical controls, and how much of the work your team carries (Design™ or Drive™) |
| Independent certification | The certification body's audit days for the cloud controls, added to the ISO/IEC 27001 audit for your scope, headcount and locations; expect additional audit time, quoted by the body |
| Internal resources and remediation | Time from cloud engineering, IT, procurement, legal and service owners, provider negotiations, and any tooling for logging, key management or configuration the plan calls for, identified in the gap analysis, never assumed |
| Software, assessment and learning | Included in a Sterling engagement: Effivity for the ISMS and its cloud controls, a vulnerability assessment of the environments you control and Sterling Academy access, with users and courses confirmed in the proposal |
| Continued support | Surveillance readiness, internal audits, provider reviews, refresher learning and extensions under Sustain™ |
What moves the price
- Provider or customer, or both roles at once, and the number of services in scope
- Public, private and hybrid deployments, and the number of cloud providers involved
- Whether an ISO/IEC 27001 certificate exists and how well its ISMS operates today
- Client-dedicated environments, data-residency commitments and regulated data
- The deadline set by the tender or the client, and the capacity your engineers can give
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Certification-body fees identified separately, so the full programme cost is comparable
- Effivity, the vulnerability assessment, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does ISO/IEC 27017 certification take?
On an operating ISO/IEC 27001 ISMS, adding the cloud controls realistically takes two to four months from kick-off to the extension audit: nearer two when the providers are few and the contracts already say who does what; nearer four when responsibilities must be negotiated, privileged access re-engineered or an exit plan written and tested for the first time. Built together with ISO/IEC 27001, the programme takes five to nine months, because the ISMS must operate long enough to produce risk assessments, access reviews, an internal audit and a management review before Stage 2.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to engineers, contracts and consoles; speed of decisions on which services, roles and providers are in scope |
| Responsibility split and control build | How quickly providers confirm their side, the number of tenants and environments, and the availability of those who own configuration and identity |
| Operation and evidence | Controls running long enough to produce privileged-access reviews, monitoring reports, provider reviews and a tested exit plan, then internal audit |
| Certification assessment | The certification body's calendar for the extension audit or the Stage 1 and Stage 2 visits, and time to close findings |
Bring the tender date or the client's deadline to the first call. We will tell you what is achievable, which decisions must be taken in the first two weeks and where the risk to the date sits. A date promised before anyone has seen your cloud estate is a sales technique, not a plan.
Challenges
Common ISO/IEC 27017 implementation challenges
Cloud control programmes stall for predictable reasons; each has a working answer.
Nobody can say where the provider's responsibility ends and ours begins.
We build the responsibility matrix control by control, from the provider's published commitments and your contract, and record the decisions in Effivity. Whatever is neither the provider's nor yours becomes a risk to treat.
The certificate covers head office; the product lives in the cloud.
Scope follows the services your clients use. We rewrite the scope statement around them, extend the risk assessment and the SoA and agree the wording with the certification body before the audit.
The cloud team works in consoles and pipelines, not in policies.
Controls are expressed as baselines, identity rules, logging settings and pipeline checks the engineers already understand; evidence is exported, not retyped.
We consume a dozen cloud services and have contracts for three.
A cloud service inventory with owner, data, deployment model and contract status; provider assessments prioritised by risk; agreements brought up to what the controls require.
We are asked for ISO/IEC 27018, SOC 2 and CSA STAR as well.
One control set and one evidence base serve the ISMS certificate, the ISO/IEC 27018 controls, a SOC 2 report and a CSA STAR assessment; we map once and plan the additions around the audit calendar.
Your engagement
What your ISO/IEC 27017 engagement includes
Your agreed scope covers everything operating cloud controls and a prepared team need. Many providers deliver a cloud policy and a mapping spreadsheet and leave the negotiations, the fixes and the audit to you; a Sterling engagement carries the whole programme, one team, one all-inclusive proposal.
Scope, gap analysis and implementation plan
Cloud services, roles and providers defined, the gap against ISO/IEC 27017:2026 measured, and a plan with owners, dates and decision points.
Shared-responsibility matrix, risk assessment and documentation
The responsibility split agreed per provider or customer, cloud risks in the register, the SoA extended, and policies and procedures on Sterling's ISMS and cloud template sets, adapted to how you work.
Effivity ISO & GRC software
Your ISMS and its cloud controls run in Effivity from day one, included with the engagement at no additional cost.
Vulnerability assessment
A vulnerability assessment of the cloud environments you control, with the findings fed into the treatment plan and tracked to closure.
Learning for the whole workforce
Internal auditor training for your audit team, as applicable to your standard, plus preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit, management review and certification support
Conducted or facilitated as agreed, findings closed with evidence, then support through the extension audit or Stage 1 and Stage 2 until the certificate is issued or updated.
Certification decisions remain with the independent certification body.
How we deliver
How Sterling supports your ISO/IEC 27017 implementation
Every ISO/IEC 27017 engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. You choose how much of the work your team carries; the method, software and accountability do not change.
- 01Design™Guided implementation: your cloud, IT and business teams implement with Sterling's structure, templates, responsibility workshops and coaching.
- 02Drive™Fully managed consulting: Sterling consultants carry the agreed work, from provider assessments and the responsibility matrix to the SoA update and audit preparation, with your control owners.
- 03Sustain™Post-certification operation: provider reviews, privileged-access reviews, configuration checks, internal audits, surveillance readiness and new-hire awareness, year after year.
- 04Automate™The ISMS and its cloud controls running in Effivity: services, providers, responsibilities, risks, the SoA, evidence, audits, actions and management review in one workspace.
- 05Revise™Extensions and changes: ISO/IEC 27018, SOC 2, CSA STAR, new services, providers or regions, and future editions of the standard.
Often combined with
Standards organisations pair with ISO/IEC 27017
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- ISO/IEC 27701ISO/IEC 27701 certification consulting: privacy management for controllers and processors of PII, built on your ISMS and prepared for an accredited audit.
- ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
Effivity · ISO/IEC 27017 software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of ISO/IEC 27017:2026.
Every Sterling ISO/IEC 27017 engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the ISMS workspace within the agreed scope, so cloud services, providers, the responsibility matrix, risks, the SoA, control evidence, privileged-access reviews, audits and management review sit in one place and the auditor reviews live cloud controls rather than a folder of console screenshots. For Sterling consulting clients the Effivity subscription is included with the engagement, at no additional cost.
Cloud services, roles and scope
Every cloud service you provide or consume with its deployment model, your role, the data it holds and the contract behind it, feeding the scope the certificate must cover.
Cloud risks, treatment and the SoA
Risks for each service and provider with owners, consequence and likelihood; treatment tied to the cloud controls; an SoA showing the ISO/IEC 27002:2022 controls and the cloud-specific additions with status.
Providers, agreements and the responsibility split
Supplier assessments, cloud service agreements and the responsibility matrix per service, with review dates and provider evidence.
Cloud administrators and users
Training and awareness records for administrators and users, linked to Sterling Academy; access to tenants recorded by role, reviewed and removed for leavers.
Facilities you control and attestations you rely on
Your own sites covered in the ISMS; providers' data-centre certificates and attestations filed against the services that depend on them.
Configuration, access, logging and backup evidence
Configuration baselines, privileged-access reviews, key-management decisions, monitoring reports and restore tests captured as work is done, exported rather than retyped.
The controls that exist only for the cloud
Responsibility allocation, asset return at exit, tenant separation, virtual machine hardening, administrator operations, customer monitoring and virtual-network alignment, each with owner, status and evidence.
Metrics, internal audit and management review
Cloud security metrics on live dashboards; audit programmes across the ISMS and the cloud controls with findings and follow-up; a management review with decisions and actions recorded.
What this means at the audit
The auditor asks for the scope, the responsibility matrix, the SoA, the provider assessments, the last privileged-access review, the monitoring evidence, the exit plan, the internal audit report and the management review minutes. In Effivity each is a screen with dates, owners and evidence attached, not an export compiled the week before. After certification, Sustain™ runs in the same workspace, so the surveillance auditor finds controls that never stopped.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your service inventory, provider assessments, SoA and policies migrated, not retyped
- Admin and user training for your team
- Modules for PIMS, QMS, BCMS, PCI DSS and more when you integrate standards
ISO/IEC 27017 client experience
Client letters on file, available on request.
Signed client letters for ISO/IEC 27017 are available on request. The client feedback wall lists every letter by standard.
Where ISO/IEC 27017 usually sits
How a cloud assurance programme is run.
- 01How integrated programmes run
Cloud provider: ISO/IEC 27001, 27017 and 27018 with SOC 2 as one programme
A SaaS or hosting provider commonly certifies its ISMS to ISO/IEC 27001 with the ISO/IEC 27017 controls in scope, adds ISO/IEC 27018 where it processes personal data for customers, and produces a SOC 2 report for clients that ask. In such a programme one service inventory, one responsibility matrix, one risk register and one evidence base serve every assurance, the certification audit and the SOC 2 examination share one calendar, and a CSA STAR assessment sits on the same system.
Sterling Academy · ISO/IEC 27017 e-learning
Train the people who administer, procure and use cloud services, not only security.
Most cloud incidents trace back to a person: a storage bucket left open, a key committed to a repository, a leaver still inside a tenant. Sterling Academy delivers e-learning for the whole workforce and for the people who run the cloud controls: video lessons with checkpoints, a final exam and a numbered Certificate of Completion. Sterling consulting clients receive preferential Sterling Academy course access and special pricing through their consultant, including complimentary awareness training for their people as part of the engagement.
- ISO/IEC 27017 awareness for every employee, the awareness evidence the ISMS asks for
- Practitioner courses for the ISMS lead, administrators, procurement and service owners
- Internal auditor training for the people who will audit the cloud controls, as applicable to your standard, as part of the engagement
- Learner progress by department and a training status report for the certification auditor
- New hires, contractors and administrators trained as they arrive, so awareness evidence is current at every audit
- A Sterling consultant reachable when a learner needs one
Sterling Academy courses for an ISO/IEC 27017 programme
Who learns what in a cloud controls programme.
Cloud Security and Privacy (ISO/IEC 27017 & ISO/IEC 27018)
What the standard requires of the organisation and each person who uses cloud services: what may be stored where, sharing and access in cloud applications, multi-factor authentication, reporting events, and why the responsibility split matters.
View the courseDocumented Information Management
Creating, approving, controlling and retiring the policies, procedures and records that carry the cloud controls, including the responsibility matrix, under clause 7.5, so what the auditor reads is current and owned.
View the courseNonconformity Management
Raising, investigating and closing nonconformities from internal audits, cloud incidents and certification audits: root cause, correction, corrective action and evidence the fix worked, under clause 10.2.
View the courseRisk Management
Risk assessment and treatment for cloud services as clauses 6.1.2 and 6.1.3 describe them: criteria, identification per service and provider, consequence and likelihood, control selection against Annex A and ISO/IEC 27017, and the SoA.
View the courseInternal auditor training
Delivered by your Sterling consultant for the people who will audit the cloud controls, with exercises on your own services and SoA, and a Certificate of Competence.
Integrating other standards?
Awareness courses for ISO/IEC 27001, ISO/IEC 27701, ISO 22301, ISO 9001 and more, so an integrated system trains one workforce on one platform.
See all coursesAccess for Sterling consulting clients is arranged through their consultant. A Sterling Academy certificate evidences training; certification of the ISMS and its cloud controls is decided only by the independent certification body.
Keep exploring
Explore more about ISO/IEC 27017
Watch a video on how to implement ISO 27017 here.
Watch a video on ISO 27017 requirements here.
ISO/IEC 27017 resources
Services for ISO/IEC 27017
Why Sterling
Want successful ISO/IEC 27017 certification? Come to Sterling.
Whether you are a provider adding one platform to the certificate or an enterprise governing a dozen cloud services across regions, Sterling helps you build one set of cloud controls with clear ownership, working through differences in provider terms, data-residency rules and client contracts.
Information security in 60+ countries since 2003
ISMS implementations for SaaS and hosting providers, BPOs, fintechs and public-sector suppliers, extended to the ISO/IEC 27017 controls, with one engagement team accountable in every country.
All-inclusive proposal
Consulting, Effivity, the vulnerability assessment, training and Academy access in one proposal, certification-body fees identified separately. No surprises, ever.
Controls your engineers will keep
Baselines, identity rules and logging settings expressed the way cloud teams work, evidence exported from the platforms and a system in Effivity, so the controls survive the next release.
Expert and experienced consultants
Consultants who have advised on information security management systems across sectors and countries since 2003 and know how providers, customers and certification bodies read the cloud controls.
The Sterling Promise
What our ISO/IEC 27017 certification success guarantee means
We stay with you until the agreed ISO/IEC 27017 certification outcome is achieved: through the responsibility split, the control build, the internal audit and the resolution of any findings the certification body raises. Plain explanations, practical delivery, included software and workforce learning turn the investment into a capability.
The engagement defines the standard, scope, outcome and responsibilities. Your organisation provides accurate information, gives access to the environments and contracts in scope and puts the agreed controls into operation; commitments that depend on a provider are pursued with that provider and recorded as risks where they cannot be obtained. The independent certification body assesses conformity, and its decision remains its own. Our commitment covers the agreed certification support; it is not a warranty that no incident will ever occur.
After certification
What happens after ISO/IEC 27017 certification?
The cloud controls follow the ISO/IEC 27001 certificate's three-year cycle. The certification body returns for a surveillance audit at least once a calendar year, the first within twelve months of the certification decision, and for recertification before the certificate expires; the cloud controls are examined at each visit. Between visits the controls have to keep producing evidence: provider reviews, privileged-access reviews, configuration checks, monitoring, internal audits and management reviews.
Cloud estates change faster than any audit cycle: services are adopted, providers change their terms, regions are added. Under Sterling OS™ Sustain™ we run the provider reviews, internal audits and surveillance preparation with you, keep the service inventory and responsibility matrix current, and update the SoA as services, providers or editions change.
FAQs
Frequently asked questions about ISO/IEC 27017
Can we be certified to ISO/IEC 27017 on its own?
No. ISO/IEC 27017 is a guidance standard of controls; it has no management-system requirements to certify against. Certification bodies assess the cloud controls as part of an ISO/IEC 27001 certification and record them on that certificate's scope or on a supplementary certificate. An "ISO 27017 certificate" with no ISO/IEC 27001 certification behind it is not accredited certification.
What changed with ISO/IEC 27017:2026, and is a certificate referencing the 2015 edition still valid?
The second edition, published in July 2026, replaces the 2015 edition and is built on ISO/IEC 27002:2022, so its cloud guidance follows the four control themes of the 2022 catalogue rather than the old numbering. Each certification body decides how and when the reference on a certificate moves to the new edition; ask yours for its timetable, and plan the re-mapping of your cloud controls and SoA for the next surveillance audit.
What is the difference between ISO/IEC 27017 and ISO/IEC 27018?
Both extend ISO/IEC 27002 for the cloud and both are assessed with ISO/IEC 27001. ISO/IEC 27017 covers information security for the provision and use of cloud services, for providers and customers. ISO/IEC 27018:2025 covers the protection of personally identifiable information by public cloud providers acting as PII processors. A provider that processes personal data for customers usually needs both; a customer normally needs ISO/IEC 27017 and looks to its providers for 27018.
Our provider is ISO/IEC 27017 certified. Does that cover us?
No. A provider's certificate covers the provider's management system and the controls it operates for the platform, not how you configure the service, manage identities and keys, monitor your tenancy or plan your exit. The major providers say so themselves: customers are not certified by association. Your own ISMS has to cover your side.
We only use cloud services; we do not provide any. Is ISO/IEC 27017 still relevant?
Yes. The standard is written for cloud service customers as much as providers, and applies to public, private and hybrid deployments. For a customer the value is a defined split of responsibilities with each provider, controls over your administrators, configuration, logging and exit, and a certificate that names the platforms you run on.
How will ISO/IEC 27017 appear on our certificate?
It depends on the certification body and its accreditation body. Some record the cloud controls in the scope wording of the ISO/IEC 27001 certificate; some issue a supplementary certificate that refers to it; in some countries a dedicated cloud security certification is granted only to organisations that hold ISMS certification. Ask the body how the result will read before you commit, and check that it satisfies the client or tender.
How does ISO/IEC 27017 relate to SOC 2 and CSA STAR?
SOC 2 is an attestation report on a service organisation's controls, issued by a CPA firm against the AICPA Trust Services Criteria, not a certificate. CSA STAR is the Cloud Security Alliance's registry of cloud providers' controls: at Level 2, STAR Certification combines ISO/IEC 27001 with the Cloud Controls Matrix, and STAR Attestation combines SOC 2 with the same matrix. An ISMS with the ISO/IEC 27017 controls is the natural base for both, and one evidence set can serve all three; none replaces another.
Can the cloud controls be added at our next surveillance audit?
Usually, yes. Extending the scope of an existing certificate is a recognised step under ISO/IEC 17021-1 and may be carried out in conjunction with a surveillance audit, subject to the body's planning and the extra time needed. We align the implementation, internal audit and management review with that visit.
What do you need to prepare an ISO/IEC 27017 proposal?
The cloud services you provide or consume and their deployment models, the providers involved, whether an ISO/IEC 27001 certificate exists and who issued it, approximate headcount and sites, the client or tender requirement behind the enquiry, and your deadline. That is enough for a scoped, all-inclusive proposal.
Before the first call
Prepare a useful ISO/IEC 27017 readiness brief
You do not need a responsibility matrix before the first conversation; a short account of which cloud services you provide or use, who is asking for assurance and what certificate you hold is enough. Seven questions:
- Who is asking for ISO/IEC 27017, or for 27018, SOC 2 or CSA STAR, and what exactly does the questionnaire, tender or contract require?
- Which cloud services do you provide, which do you consume, on which deployment models, and which hold client or personal data?
- Do you hold an ISO/IEC 27001 certificate, from which body, with what scope, and when is the next audit?
- For each provider, what does the contract say about who secures what, and what has never been written down?
- How are cloud administrator accounts granted, logged and reviewed today, and how would you know if a tenant were misconfigured?
- If you had to leave a provider next quarter, how would data come back, be verified and be deleted?
- Who can take decisions on scope and provider terms, and who from engineering, procurement and legal can give time to implementation?
These answers let us scope the work and prepare a realistic proposal. They prepare a conversation; they are not a scored assessment and not a certification decision.
Don’t be fooled by certification scams
If it takes ten days, it is not ISO/IEC 27017 certification.
An ISO/IEC 27017 result is worth something when it sits on an accredited ISO/IEC 27001 certificate whose scope names the cloud service your clients use and the controls behind it can be examined. The market also sells the other kind: "ISO 27017 certificates" with no ISMS certification behind them, badges from bodies nobody accredits, and mapping spreadsheets presented as implementation. They are cheaper, until a client checks.
How to choose a credible ISO/IEC 27017 provider
- Ask which ISO/IEC 27001 certificate the cloud controls will sit on, who issues it and under which accreditation, and check it on the body's public register.
- Ask how the result will be worded. A certificate that does not name the cloud service, or a supplementary certificate with no valid ISO/IEC 27001 certificate behind it, will not survive a client's check.
- Ask who will agree the responsibility split with your providers or customers. A matrix copied from a provider's website is the provider's view, not your control set.
- Ask what happens in your cloud environments. A credible programme looks at your configuration, identities, logging and exit plan; one that never opens a console does not know what it is preparing you for.
- Ask what your people will learn and where the evidence will live. No awareness training and no system of record means the controls stop when the consultant leaves.
- Walk away from "ISO 27017 certified in days", "no ISO 27001 needed" and one invoice for consulting and certificate. The controls have to operate, be audited internally and be reviewed by management before a body has anything to examine.
Keep exploring
More on ISO/IEC 27017 and related standards
More in Information security, cyber & cloud
Talk to a consultant
Plan your ISO/IEC 27017 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice