Platform
Modules
By sector
By sector
By standard
Blog
News
Events
ISO/IEC 27017
Organisations using or providing cloud services that need the shared-responsibility boundary evidenced.
ISO 27017 extends the ISO 27002 controls to cloud services and adds controls specific to them. ComplyTrain holds each one as a requirement, including the ones that belong to your provider rather than to you.
ISO/IEC 27017 is a code of practice for information security in cloud services. It does two things: it gives cloud-specific implementation guidance for controls you already know from ISO 27002, and it adds controls that only exist because the service is cloud - segregation in virtual environments, administrator operations, monitoring, and the return or removal of assets when a contract ends.
It is written for both sides. A cloud service customer and a cloud service provider read the same control and each has their own part of it, which is the point of the standard.
Most cloud security findings are not a control that failed. They are a control that both parties assumed the other one owned. ISO 27017 exists to make that boundary explicit, and the useful output of applying it is a documented division of responsibility you can show an auditor and hand to a customer.
There is no standalone ISO 27017 certificate. It extends an ISO 27001 ISMS, and the controls you adopt from it become part of your Statement of Applicability.
Alongside the cloud-specific guidance on familiar controls, ISO 27017 adds a small set that has no on-premises equivalent. They cover the shared roles and responsibilities between customer and provider, the removal or return of customer assets when a service ends, the separation of customers in a shared virtual environment, hardening of virtual machines, administrator operations that could affect many customers at once, monitoring that the customer can actually see, and alignment of the virtual and physical networks.
Read as a group, they are a list of the things that go wrong specifically because a service is multi-tenant and someone else runs it. That is a useful way to approach them: not extra paperwork, but the failure modes the model introduces.
Where a control depends on a supplier, vendor management holds the assessment, and requirements management keeps the control traceable to the evidence that satisfies it.
ComplyTrain itself runs in the EU, in AWS eu-central-1, and isolates each customer at the database, identity, storage and key level - a separate schema, a separate identity pool, a separate bucket and a separate encryption key per tenant. If you are applying ISO 27017 to your own suppliers, that is the answer to the question you will be asking us.
Tell us how you need to work with ISO/IEC 27017 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
Not on its own. ISO 27017 extends an ISO 27001 ISMS, and the cloud controls you adopt become part of your Statement of Applicability. Some certification bodies will note the extension on an ISO 27001 certificate.
ISO 27017 covers information security in cloud services generally. ISO 27018 covers the protection of personally identifiable information specifically, when you process it in a public cloud as a processor. Many organisations apply both, and they share the same ISMS.
Yes, and that is the more common case. The standard is written for customers as well as providers, and the customer-side controls are the ones most often assumed to belong to the provider.
Both of you, in different parts, which is why recording the split matters more than the label. The failure mode is not disagreement about a boundary, it is never having drawn one.
It covers their half. A provider certificate tells you the controls on their side of the boundary were assessed; it says nothing about the controls on yours, and those are usually the majority for a customer. The useful artefact is your own record of which is which.
Until its scope or its date stops matching what you rely on, which is sooner than most registers assume. A certificate collected once and never reviewed is evidence about a moment that has passed - which is why the review date belongs on the control, not in someone's calendar.
The process
ISO 27017 is not certifiable on its own. It extends an ISO 27001 certificate with controls written for cloud, and it addresses the provider and the customer separately.
The same control reads differently for a cloud service provider than for a customer of one. Most organisations are both, for different services, and the scope has to say which is which.
ISO 27017 adds controls that ISO 27002 does not cover, including virtual machine hardening, administrative operations and the removal of your data when a service ends.
Cloud security is shared, and the split is only useful if it is written down. Record which controls your provider operates, which are yours, and what evidence each side supplies.
Your own controls produce their own evidence. For the provider side, keep the certificates, reports and contract terms you rely on, and review them when they expire.
A standard usually arrives as a contract condition rather than a project anyone planned for, and often at a company with no quality manager. Software is half the answer. Skylen's consultants are the other half, and because they build on ComplyTrain from day one you keep a live system your team owns rather than a binder and a departed consultant.
A clause-by-clause read of where you stand against the standard your contract cites, turned into a prioritised plan you could act on with us or alone.
What an assessment coversOur consultants build the system with your team - procedures, document control, the records you need to keep and the review cadence - and prepare you for the certification audit.
How an engagement worksWe run and maintain the quality system for you, so a small team can reach and hold a standard without hiring a quality manager.
What full-service meansOne system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
A 90-day plan for the smallest defence suppliers: let the tender set your scope, document what you already do, fix the security basics primes check, and keep the system small enough for two people to maintain.
Learn how to qualify, approve and monitor sub-suppliers, flow down requirements through purchase orders, and keep the records an auditor will ask to see under ISO 9001 clause 8.4 and AQAP.
Learn how to run an ISO 9001 Clause 9.3 management review that turns evidence into decisions, with the right inputs, actionable outputs, and a cadence that fits your risks.