ISO 27017 — Cloud Security Controls
ISO/IEC 27017 provides additional information-security controls specific to cloud service providers and customers, extending ISO 27001 into shared-responsibility cloud environments.
Why it matters
As organisations increasingly rely on cloud infrastructure, ISO 27017 clarifies the division of security responsibilities between cloud provider and customer, and adds controls for virtualisation, cloud admin operations and tenant isolation.
Certification is typically pursued alongside ISO 27001, extending your existing ISMS scope to cover cloud-specific risks.
WHY PURSUE THIS
Benefits of ISO 27017 certification
Clear responsibility boundaries
Removes ambiguity over who secures what across provider and customer.
Stronger tenant isolation
Additional controls for virtualisation and multi-tenant environments.
Customer assurance
A credible, independently verified answer to cloud security due diligence.
Builds on ISO 27001
Extends your existing ISMS scope rather than starting from scratch.
STAKEHOLDER TRUST
Supporting the Sustainable Development Goals (SDGs)
SDG 9
Industry, Innovation and Infrastructure
SDG 16
Peace, Justice and Strong Institutions
SDG 8
Decent Work and Economic Growth
SDG 17
Partnerships for the Goals
“In the cloud, trust is not assumed, it is demonstrated through clear, auditable controls.”
Marcus Lindqvist, Lead Information Security Assessor, RBA Registrars
Organisations that benefit from certification
Cloud service providers
SaaS platforms
Managed IT service providers
Data centre operators
Public sector digital services
Financial services & fintech
What we audit
What we assess for Cloud Security
Our assessors evaluate objective evidence against each focus area below and record findings in a formal audit report.
01
Cloud-Specific Security Controls
The seven additional Annex A controls unique to cloud service delivery.
02
Shared Responsibility Model
Clear allocation of security duties between provider and customer.
03
Virtualisation & Asset Return
Hardening of virtual environments and secure de-provisioning of assets.
04
Data Removal & Access Rights
Evidence that customer data is removed on contract termination.
Related Standards & Services
Explore other certification schemes and services offered by RBA Registrars.
Ready to begin your ISO 27017 certification journey?
Tell us about your organisation and we’ll return a fixed-price proposal — no obligation.