Cloud-specific security controls, certified on top of ISO 27001. The cheapest certificate most cloud providers can add, because the management system already exists.
What is ISO 27017?
ISO/IEC 27017:2015 is a code of practice for information security in cloud services. It takes the ISO 27002 controls and adds cloud-specific implementation guidance, plus seven controls that exist only in the cloud context, covering things like the division of responsibility between provider and customer, virtual machine hardening, and what happens to data when a contract ends.
It is not a standalone management system, and it is not certified on its own. It is audited as an extension of an ISO 27001 ISMS, which is what makes it cheap to add: the scope, risk process, internal audit and management review are already there. For a cloud provider already holding ISO 27001, this is usually a scope extension at the next surveillance audit rather than a new programme.
One point worth knowing before you start. A second edition is in development to align the standard with the ISO 27002:2022 control set, and organisations certified to the 2015 edition should expect a transition window once it is published. That is a reason to plan the work, not a reason to delay it, because the management system underneath does not change.
Compliance requirements
Cloud-specific controls that sit on top of the Annex A set your ISMS already implements.
The division of security responsibilities between cloud provider and cloud customer, documented rather than assumed. The single most useful thing this standard produces.
What happens to data, configuration and virtual resources when the contract ends, and how the customer can verify it happened.
Separation of a customer’s virtual environment from those of other customers sharing the same infrastructure.
Configuration baselines for virtual machines, applied to meet business need rather than shipped as default.
Documented procedures for administrative operations with the potential to affect many customers at once.
The capability for a customer to monitor their own use of the service, and the information the provider must make available for them to do it.
Consistent security management across virtual networks and the physical networks underneath them.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
ISO 27017 is audited as an extension of ISO 27001, so we confirm your ISMS is in place, or implement it concurrently, before adding the cloud scope.
We establish where you act as cloud provider, where as cloud customer, and often both, because the controls differ by role.
We assess your current cloud controls against the ISO 27017 guidance and the seven cloud-specific controls.
Your compliance manager documents the responsibility split with your customers, which is both an audit requirement and a commercial asset.
We close the gaps across segregation, hardening, administrative operations and customer monitoring.
We manage the certification body, normally folding the ISO 27017 scope into your existing audit cycle rather than running a separate one.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone