Skip to main content
Cyber Risk Council
Category: Cloud Security

ISO/IEC 27017

Also known as: ISO 27017, ISO/IEC 27017:2015, ISO/IEC 27017 Code of Practice for Information Security Controls for Cloud Services
Simply put

ISO/IEC 27017 is an international standard that offers guidance on information security controls specifically for organizations that provide or use cloud services. It builds on the broader ISO/IEC 27002 standard by adding recommendations tailored to the shared responsibilities and risks of cloud environments. It is intended to help both cloud providers and their customers make cloud-based operations safer.

Formal definition

ISO/IEC 27017 is a code of practice that provides guidance for implementing information security controls applicable to the provision and use of cloud services. It is based on and extends ISO/IEC 27002, adding cloud-specific control guidance and implementation direction relevant to both cloud service providers and cloud service customers. It functions as a reference for selecting and applying cloud information security controls rather than as a standalone certifiable management system standard; in practice it is typically applied alongside an ISO/IEC 27001 information security management system. A virtual CISO engagement may support readiness and control selection against this guidance, but adherence to it does not by itself constitute or guarantee certification, and accountability for security decisions typically remains with the client organization.

Why it matters

Cloud adoption reshapes the security responsibilities of an organization, and one of the most persistent sources of risk is confusion over who is accountable for which controls. ISO/IEC 27017 matters because it directly addresses the shared responsibility model between cloud service providers and their customers, offering cloud-specific control guidance that the more general ISO/IEC 27002 does not fully cover. For leadership, this clarity helps prevent the common and costly assumption that moving to the cloud transfers security obligations entirely to the provider.

The standard is also increasingly relevant to buyers evaluating vendors and to organizations answering their own customers' due diligence questions. Because ISO/IEC 27017 is a code of practice rather than a standalone certifiable management system standard, its value comes from how well it is applied alongside an ISO/IEC 27001 information security management system. Treating it as a source of implementation guidance, rather than a checkbox or a guarantee, is what separates a mature cloud security program from one that merely claims cloud awareness.

It is worth stressing that adherence to ISO/IEC 27017 does not by itself constitute or guarantee certification, nor does it prevent breaches. Its practical benefit depends heavily on organizational maturity, the accuracy with which shared responsibilities are documented, and the cooperation of both provider and customer in implementing the recommended controls.

Who it's relevant to

Cloud service customers
Organizations consuming cloud services can use ISO/IEC 27017 to understand which security controls remain their responsibility and which fall to their providers. This guidance helps buyers avoid the frequent mistake of assuming that a move to the cloud transfers all security obligations to the vendor. The value depends on accurately documenting the shared responsibility split for each service in use.
Cloud service providers
Providers can reference the standard to structure and communicate the cloud-specific controls they implement and to clarify the boundary between their obligations and those of their customers. Applying the guidance can support customer due diligence and vendor evaluation processes, though it does not by itself constitute certification.
Security and compliance leaders
CISOs, virtual CISOs, and compliance leaders may use ISO/IEC 27017 to inform control selection within an existing or planned ISO/IEC 27001 management system. A vCISO can support readiness and help map cloud-specific guidance to the environment, while accountability for the underlying security decisions remains with the client organization.
Executives and buyers of security leadership
Business leaders evaluating cloud strategy or engaging fractional or virtual security leadership benefit from understanding that ISO/IEC 27017 is guidance, not a guarantee. It should be treated as a governance and risk tool that clarifies responsibility boundaries, not as assurance that cloud operations are automatically secure or certified.

Inside ISO/IEC 27017

Cloud-specific control guidance
ISO/IEC 27017 provides implementation guidance for information security controls applicable to the provision and use of cloud services, building on the controls established in ISO/IEC 27002 rather than replacing them.
Additional cloud controls
The standard introduces controls that are specific to cloud environments and not fully addressed in the general ISO/IEC 27002 guidance, addressing considerations that arise from the shared nature of cloud service delivery.
Shared responsibility clarification
It offers guidance intended to help clarify the division of security responsibilities between the cloud service provider and the cloud service customer, an area where scope and accountability often need explicit definition.
Dual audience orientation
The guidance is structured to address both cloud service providers and cloud service customers, recognizing that each party has distinct roles in implementing and maintaining controls.
Relationship to the ISO 27000 family
ISO/IEC 27017 functions as a code of practice that complements an information security management system approach and is commonly considered alongside ISO/IEC 27001 and ISO/IEC 27002 rather than in isolation.

Common questions

Answers to the questions practitioners most commonly ask about ISO/IEC 27017.

Is ISO/IEC 27017 a standalone certification a cloud provider can hold on its own?
Not in the way many assume. ISO/IEC 27017 is a code of practice that provides cloud-specific security controls and implementation guidance layered on top of ISO/IEC 27001 and ISO/IEC 27002. It is typically assessed and referenced within the context of an ISO/IEC 27001 information security management system rather than as an independent certificate standing alone. When a provider claims alignment with 27017, a virtual CISO would advise confirming how it relates to their underlying 27001 program and what scope was actually assessed, since the guidance supplements existing controls rather than replacing them.
Does using a cloud provider that references ISO/IEC 27017 mean my organization's cloud security is covered?
No. ISO/IEC 27017 addresses shared responsibility between cloud service providers and cloud service customers, and it explicitly assigns certain controls to the customer. A provider's alignment with the standard does not transfer accountability for your configuration, access management, or data governance to that provider. In many engagements a virtual CISO helps clarify which controls fall to the provider versus the customer, since organizational and legal accountability for security decisions typically remains with the client and its officers regardless of the provider's posture.
How can a virtual CISO help our organization use ISO/IEC 27017 in practice?
A virtual CISO generally provides strategy and governance guidance around adopting the standard, such as mapping cloud-specific controls to your existing security program, interpreting the shared responsibility model for your environment, and helping prioritize gaps. This work is typically advisory and readiness-oriented rather than hands-on. Activities such as configuring cloud platforms or administering security tooling usually fall outside a vCISO's scope unless explicitly contracted.
What should we clarify before relying on a provider's ISO/IEC 27017 controls?
It often helps to confirm the scope of what was assessed, how the provider documents the split of controls between them and the customer, and which controls the standard assigns to your organization. A virtual CISO can help you review provider documentation and shared responsibility matrices so that customer-side obligations, such as identity management and data protection, are not assumed to be handled by the provider. Value here depends on access to accurate provider documentation and your own environment details.
Does adopting ISO/IEC 27017 guarantee compliance with regulations like GDPR or HIPAA?
It does not. ISO/IEC 27017 offers cloud security guidance and can support a stronger control environment, but it is distinct from regulatory compliance regimes. Alignment with the standard may contribute to readiness for certain regulatory expectations, yet it does not by itself assert or guarantee compliance with any specific law. A virtual CISO would typically distinguish between supporting readiness and claiming regulatory compliance, and recommend appropriate legal or specialist input where regulations apply.
How does organizational maturity affect the value of applying ISO/IEC 27017?
Because the standard builds on an ISO/IEC 27001 information security management system and assumes an ability to act on shared responsibility controls, its practical value often depends on your existing security governance, cloud usage patterns, and stakeholder engagement. Organizations with limited security processes may need foundational work before the cloud-specific guidance can be applied effectively. In many engagements a virtual CISO helps sequence this work realistically, and outcomes may vary by client cooperation and defined scope.

Common misconceptions

ISO/IEC 27017 is a standalone certification that proves a cloud environment is secure.
It is guidance built on ISO/IEC 27002 and does not, on its own, guarantee security outcomes. Its value depends on how the guidance is implemented, and organizations should distinguish between supporting readiness or alignment and asserting a formal certification.
Adopting ISO/IEC 27017 shifts security accountability to the cloud service provider.
The standard helps clarify the shared responsibility model, but legal and organizational accountability for security decisions typically remains with the customer organization and its officers. The guidance describes how responsibilities may be divided; it does not transfer accountability unless a contract specifies otherwise.
A virtual CISO engagement referencing ISO/IEC 27017 will make the client compliant or certified.
A virtual CISO typically advises on governance, risk, and program development and can support readiness against the guidance, but does not guarantee compliance or certification. Outcomes vary and depend on organizational maturity, client cooperation, and defined engagement scope.

Best practices

Use ISO/IEC 27017 alongside ISO/IEC 27002 and an ISO/IEC 27001 management system approach rather than treating it as an independent checklist, so cloud-specific guidance is applied within a broader information security program.
Explicitly document the shared responsibility split between provider and customer for each cloud service, and reconcile it against contractual terms rather than assuming responsibilities are covered by default.
When a virtual CISO advises on ISO/IEC 27017, define in the engagement scope whether the work supports readiness and alignment versus formal certification, and set expectations accordingly with client stakeholders.
Confirm whether hands-on control implementation, tool administration, or operational tasks fall inside or outside the engagement, since a virtual CISO typically provides strategy and governance guidance rather than executing operational cloud controls.
Assess the client's cloud governance maturity and stakeholder access before committing to outcomes, recognizing that the value of applying the guidance depends heavily on organizational cooperation and defined scope.
Address both provider-facing and customer-facing considerations in any gap assessment, reflecting the dual-audience structure of the guidance and avoiding the assumption that responsibilities rest solely with one party.