ISO 27017

ISO/IEC 27017 is a code of practice that adds cloud-specific guidance to the ISO/IEC 27002 controls, for cloud service providers and cloud customers. The current edition is ISO/IEC 27017:2026 (Edition 2, published July 2026), titled Information security, cybersecurity and privacy protection: Information security controls based on ISO/IEC 27002 for cloud services.

It replaced the 2015 edition, which ISO withdrew on July 27, 2026. We have not yet read the 2026 text.

The 2015 edition added seven controls, covering shared roles and responsibilities, removal and return of customer assets, segregation in virtual environments, virtual machine hardening, administrator operational security, monitoring of cloud services, and alignment of virtual and physical network security; whether and how the 2026 edition changes them has not been checked here.

It is not a management system standard and cannot be certified on its own. Certification bodies issue ISO 27017 as an extension of an ISO/IEC 27001 certificate, so the organization must have a certified ISMS and then document how the 27017 controls are implemented: a shared responsibility matrix, cloud-specific policies and procedures, customer-facing documentation of security functions, and evidence of the added controls in the Statement of Applicability.