For cloud customers
Lower risk, clear responsibilities, better migration decisions and better management of contracts and service expansions.
ISO/IEC 27017 · Cloud services
ISO 27017: security controls for cloud services
The code of practice, based on ISO/IEC 27002, that defines clear responsibilities between cloud provider and customer.
What is ISO 27017?
Cloud security, with clearly defined roles
It's part of the ISO 27001 family and sets criteria for delivering cloud services.
It specifies security controls for cloud providers and customers, clarifying each party's roles and responsibilities, and integrates with any information management system.
Additional controls
Seven new controls, on top of those in ISO 27002
- 1Shared responsibilities between cloud provider and customer.
- 2Removal or return of assets when the contract ends.
- 3Protection and segregation of the customer's virtual environment.
- 4Virtual machine configuration.
- 5Cloud service operations and administrative procedures.
- 6Monitoring of customer activity in the cloud.
- 7Alignment of virtual and physical network management.
Benefits
Customers and providers both win
For cloud providers
More customer trust, stronger data protection, competitive advantage, brand reputation, legal compliance and easier international business.
Credentials
Auditors qualified in cloud security
FAQ
What clients ask us most
What is ISO 27017?
A code of practice based on ISO/IEC 27002 with security controls specific to cloud services, clarifying what falls to the provider and what falls to the customer.
Who is ISO 27017 for?
Both providers and customers of cloud services who want to demonstrate that cloud security is well managed.
Do you provide or buy cloud services?
Our auditors are qualified in ISO 27017. Let's talk.