ISO 27017 Cloud Security Controls Guide

ISO 27017 (formally ISO/IEC 27017) is the international code of practice for cloud security. It takes the information security controls of ISO/IEC 27002 and adds guidance for the two parties in every cloud relationship: the cloud service provider and the cloud service customer. It also adds controls for risks that only exist in the cloud, such as one customer's data or workloads being exposed to another in a shared environment.

For SaaS companies, ISO/IEC 27017 is usually a scope extension of an ISO/IEC 27001 certificate, and it answers the question enterprise customers ask most often about cloud services: who is responsible for what? The second edition was published in 2026 and aligns the standard with the 2022 control set. This guide explains its structure, the cloud-specific controls, how providers and customers use it, how it is audited, and how it relates to ISO/IEC 27018, CSA STAR, SOC 2 and FedRAMP.

What is ISO/IEC 27017?

ISO/IEC 27017 provides guidelines for information security controls applicable to the provision and use of cloud services. It gives:

Additional implementation guidance for relevant controls in ISO/IEC 27002, written separately for cloud service providers and cloud service customers where their responsibilities differ.
Additional controls with implementation guidance that relate specifically to cloud services.

It was developed jointly with the International Telecommunication Union, which publishes the same text as ITU-T Recommendation X.1631. It uses the cloud computing concepts and roles defined in ISO/IEC 22123 (and earlier ISO/IEC 17788 and 17789): cloud service provider, cloud service customer and cloud service partner, across service categories such as IaaS, PaaS and SaaS.

History and why ISO/IEC 27017 was introduced

As organisations moved systems into public cloud services in the early 2010s, existing security standards assumed the organisation controlled its own infrastructure. In the cloud, responsibility is split: the provider secures the platform, the customer secures its configuration, data and users, and the boundary varies by service model. Customers lacked a standard way to understand and verify that split.

The first edition of ISO/IEC 27017 was published in 2015, based on ISO/IEC 27002:2013. It added cloud-specific guidance to many controls and introduced seven extended controls, including shared roles and responsibilities, removal of cloud customer assets, segregation in virtual computing environments, virtual machine hardening, administrator operational security, monitoring of cloud services, and alignment of security management for virtual and physical networks. The second edition, ISO/IEC 27017:2026, realigns the standard with the restructured ISO/IEC 27002:2022 controls and adds new cloud-specific content, including on distributed roles and responsibilities in cloud computing.

Who uses ISO/IEC 27017?

Cloud infrastructure and platform providers, who use it to describe their side of the shared responsibility model.
SaaS companies, which are cloud service providers to their customers and cloud service customers of their own infrastructure providers at the same time.
Managed hosting and cloud service partners that operate cloud environments for clients.
Enterprises buying cloud services, which use the customer guidance to manage their own responsibilities and to ask providers the right questions.

It is global and voluntary. Some public sector cloud schemes and many enterprise buyers ask for ISO/IEC 27001 certificates that include ISO/IEC 27017.

Key concepts: the shared responsibility model

The standard's most useful idea is that every relevant control must be allocated between provider and customer. For example:

Area	Provider responsibility	Customer responsibility
Access control	Secure the provider's administrative access; offer customers user management, MFA and role features	Manage its own users, roles and MFA within the service
Cryptography	Provide encryption options and describe key management	Choose and configure encryption, manage its own keys where it chooses to
Logging	Log platform events and provide customers with logs of their tenant	Collect, review and retain the logs it receives
Backup	Describe backup capabilities and what is backed up	Configure and test backups of its own data where the service leaves this to the customer
Vulnerability management	Patch the platform and inform customers of relevant vulnerabilities	Patch what it runs on the platform (more for IaaS, less for SaaS)
Incident management	Report incidents affecting customers and agree how information is shared	Report incidents it detects to the provider and handle its own

The provider should document these allocations clearly, typically in service agreements and a customer responsibility matrix, and the customer should confirm them before using the service.

Cloud-specific controls explained

Whatever the edition's exact numbering, the cloud-specific topics that ISO/IEC 27017 addresses are consistent:

Shared and distributed roles and responsibilities

Responsibilities for security between provider, customer and any partners are defined, allocated and communicated, including when several providers are involved in delivering one service.

Removal and return of customer assets

When a contract ends, customer assets on the provider's premises, including data and backups, are returned or removed in a timely manner, as agreed. For a SaaS company, this means a reliable data export and a documented deletion process with evidence.

Segregation in virtual computing environments

A customer's virtual environment is protected from other customers and unauthorised persons. For SaaS, this is tenant isolation in the application and data layers: tenant identifiers enforced in every query, separate encryption keys where appropriate, and tests that one tenant cannot reach another's data.

Virtual machine and workload hardening

Virtual machines, containers and images are hardened to meet business needs, with unnecessary services removed and secure baselines applied.

Administrator operational security

Procedures for administrative operations in the cloud are defined, documented and monitored, especially for critical operations such as installing or changing infrastructure, deleting data or restoring backups.

Monitoring of cloud services

Customers have the capability to monitor specified aspects of the operation of the cloud services they use, such as access logs and activity relevant to their tenant.

Virtual and physical network alignment

Security policies for virtual networks are consistent with those for physical networks, so that software-defined networking does not create gaps.

Cloud guidance on general controls

Many standard controls get cloud-specific guidance, for example on supplier relationships (the provider's own suppliers), capacity management, change notification to customers, geographic location of data, legal jurisdiction and evidence collection in multi-tenant environments.

How to implement ISO/IEC 27017 step by step

Establish or extend an ISMS under ISO/IEC 27001, with cloud services in scope.
Clarify your roles: as a provider to your customers and as a customer of your infrastructure and SaaS suppliers.
Build a responsibility matrix for each service, listing which party handles each control area.
Assess risks specific to cloud: tenant isolation failures, administrator misuse, misconfiguration, provider lock-in, data location and legal access.
Apply the cloud guidance and cloud-specific controls and record them in the Statement of Applicability.
Engineer tenant isolation, admin controls and customer-facing security features: MFA, audit logs, encryption options, data export and deletion.
Document customer-facing information: security documentation, responsibility matrix, data location, incident and change notification commitments.
Manage your own cloud providers with the customer guidance: review their certifications and allocations.
Include ISO/IEC 27017 in internal audit and then in the certification audit scope.

Documentation you will need

ISMS documents under ISO/IEC 27001, with cloud services in scope.
Statement of Applicability including ISO/IEC 27017 controls and guidance.
Customer responsibility matrix and service security documentation.
Procedures for administrative operations and privileged access.
Tenant isolation design and test evidence.
Data return and deletion procedure and records.
Information about data location and sub-processors or subcontractors.
Change and incident notification procedures for customers.

Audit and certification

ISO/IEC 27017 is a code of practice, so there is no standalone certificate. Accredited certification bodies assess it as part of an ISO/IEC 27001 audit, and the resulting certificate states conformity with ISO/IEC 27001 and the controls of ISO/IEC 27017 for the cloud services in scope. Ask your certification body how and when it will assess against the 2026 edition, and verify certificates through IAF CertSearch or the certification body.

Timeline and cost considerations

For organisations already certified to ISO/IEC 27001, adding ISO/IEC 27017 usually means extra audit time and work on the cloud-specific controls and customer documentation. The biggest engineering items are tenant isolation evidence, admin access controls, customer-facing logs and data export and deletion. Costs include additional audit days, engineering, documentation and any tooling for cloud configuration monitoring.

Benefits and the risk of unclear responsibilities

ISO/IEC 27017 gives customers recognised assurance about cloud-specific controls and forces clarity about responsibilities, which reduces disputes after incidents. Unclear responsibilities are a common root cause of cloud breaches, where each side assumed the other was handling something, such as encryption of a storage bucket or review of access logs. There is no legal penalty for not adopting it, but customers may choose providers who can show it.

Common mistakes and challenges for IT companies

Relying on the infrastructure provider's certificate for controls that are your own responsibility as a SaaS provider.
No customer responsibility matrix, leaving customers to guess what they must configure.
Tenant isolation assumed, not tested. Add automated tests that attempt cross-tenant access.
Deletion at contract end that misses backups and logs, or has no evidence.
Admins with unrestricted production access and no monitoring of sensitive operations.
Customers not told about changes that affect their security, such as new sub-processors or data locations.

Best practices, tools and technologies

Publish a trust page with security documentation, the responsibility matrix, data locations and certifications.
Use per-tenant encryption keys for sensitive data where the architecture allows it.
Enforce tenant scoping in the data access layer, not only in the user interface.
Use just-in-time, approved and logged privileged access for administrators.
Give customers audit logs of activity in their tenant, exportable to their own SIEM.
Use cloud security posture management to detect misconfiguration.
Document and automate data export and deletion at the end of a contract.

We design multi-tenant SaaS products with these controls and help clients move to well-architected cloud setups in migration projects.

How ISO/IEC 27017 relates to other frameworks

Framework	Relationship
ISO/IEC 27001	The certifiable management system ISO/IEC 27017 extends.
ISO/IEC 27002	The general control guidance that ISO/IEC 27017 builds on.
ISO/IEC 27018	Companion code of practice for protecting PII in public clouds; often certified together.
CSA STAR	Cloud assurance program based on the Cloud Controls Matrix, which maps to ISO/IEC 27017.
BSI C5	German cloud criteria catalogue; overlaps with ISO/IEC 27017 topics.
SOC 2 and FedRAMP	US assurance options for cloud services; customers may ask for these instead or as well.

Real-world implementation examples

The major cloud platforms list ISO/IEC 27017 among their certifications and publish shared responsibility documentation, which is the clearest public example of the standard's central idea in practice. Many SaaS providers include ISO/IEC 27017 and 27018 in the scope of their ISO/IEC 27001 certificates for enterprise sales.

An illustrative case for a B2B SaaS platform: an enterprise customer's cloud review asks who manages encryption keys, how tenant data is separated, how administrators access production and what happens to data at contract end. The provider answers with a responsibility matrix, a tenant isolation description backed by automated tests, a just-in-time admin access process with logging, and a documented export and deletion procedure. Adding ISO/IEC 27017 to its ISO/IEC 27001 scope turns those answers into audited evidence.

Next steps

Write a responsibility matrix for each cloud service you provide and use.
Test tenant isolation and fix gaps.
Tighten admin access and monitoring.
Document data return and deletion.
Add ISO/IEC 27017 to your ISO/IEC 27001 scope and plan for the 2026 edition with your certification body.
Publish customer-facing security documentation so buyers can find answers before they ask.

Frequently asked questions

Can you be certified to ISO 27017 alone?

No. It is a code of practice assessed as an extension of ISO/IEC 27001 certification.

What is the latest version of ISO 27017?

ISO/IEC 27017:2026, the second edition, which aligns with ISO/IEC 27002:2022 and replaces the 2015 edition.

What is the difference between ISO 27017 and ISO 27018?

ISO/IEC 27017 covers information security for cloud services generally. ISO/IEC 27018 focuses on protecting personal data processed by public cloud providers acting as processors.

Does ISO 27017 apply to SaaS companies?

Yes. A SaaS company is a cloud service provider to its customers and a cloud service customer of its infrastructure providers, so both sets of guidance apply.

What is the shared responsibility model?

The allocation of security responsibilities between provider and customer, which varies by service model. ISO/IEC 27017 asks for it to be defined and communicated.

Do customers need ISO 27017?

Customers can use its customer guidance to manage their side of cloud security. Certification is mostly relevant to providers.

Is ISO 27017 required by law?

No. It is voluntary, although some public sector buyers and enterprises require it in contracts or tenders.

What is ITU-T X.1631?

The ITU publication of the same code of practice, developed jointly with ISO and IEC.

How does ISO 27017 relate to CSA STAR?

CSA's Cloud Controls Matrix maps to ISO/IEC 27017, and CSA STAR Certification builds on ISO/IEC 27001, so the work overlaps substantially.

What should a cloud provider tell customers?

Its security responsibilities and theirs, data locations, sub-processors, incident and change notification commitments, available security features, and how data is returned and deleted.

Does ISO 27017 cover data location?

Yes. Its guidance asks providers to tell customers the geographic locations where data may be stored and processed, and customers to consider legal and regulatory implications of those locations, which links to privacy and data localisation laws.

How do we prove tenant isolation?

Through architecture documentation, code-level enforcement of tenant scoping, penetration tests that include cross-tenant attempts, and automated tests that run on every change.