ISO 27017: information security for cloud services
ISO 27017 is the international guidance for information security in cloud services. It extends the controls in ISO 27002 with cloud-specific explanations and additional controls. For each control, it makes clear what the cloud provider does and what the cloud customer does. You usually have ISO 27017 assessed as an extension of your ISO 27001 certificate.
The current version is ISO/IEC 27017:2026, published in July 2026 by ISO . It replaces the 2015 version and follows the structure of ISO 27002:2022. According to ISO, it applies to all forms of cloud: public, private and hybrid.
In short: ISO 27001 asks whether your security works. ISO 27017 asks for each control: who is responsible in the cloud, the provider or the customer? This is exactly where most misunderstandings about cloud services arise.
ISO 27017 at a glance
| Full name | ISO/IEC 27017:2026, Information security controls based on ISO/IEC 27002 for cloud services |
| Previous version | ISO/IEC 27017:2015, withdrawn when the new version was published |
| Type of document | Guidance, not a standalone requirements standard |
| For whom | Cloud providers (SaaS, PaaS, IaaS) and organisations that use the cloud |
| Can you get certified? | Not on its own. In practice as an extension of an ISO 27001 certificate |
| Related | ISO 27018 for personal data in the public cloud |
What does ISO 27017 contain?
ISO 27017 follows the structure of ISO 27002. For many controls, it adds an extra piece of explanation in two columns: what the cloud customer does and what the cloud provider does. The standard also contains additional cloud controls that are not in ISO 27002.
The 2015 version had seven additional controls, with numbers starting with CLD. They covered, among other things, the division of responsibilities, returning and deleting customer data at the end of a contract, separating customer environments in a shared environment, and the customer monitoring cloud services. The 2026 version has changed the numbering to match ISO 27002:2022. If you are switching, check in the standard itself how the old CLD controls are now organised.
Example: dividing responsibilities under ISO 27017
The core of ISO 27017 is that you record, per topic, who does what. This is how it looks for a SaaS provider of accounting software.
| Topic | Cloud customer (the accountancy firm) | Cloud provider (the SaaS provider) |
|---|---|---|
| User management | Creates accounts and removes them when employees leave | Offers MFA and roles, and secures the login environment |
| Back-up | Decides whether their own exports are needed | Makes daily back-ups and tests recovery |
| Separation of customers | No task | Makes sure customer A never sees data of customer B |
| Administrator actions | Can request logging | Records which administrators can access customer data and logs their actions |
| End of contract | Exports data within the agreed period | Returns data and demonstrably deletes it |
| Vulnerabilities | Maintains their own devices | Patches the platform and reports relevant vulnerabilities |
Put a table like this in your contract or your customer documentation. A SaaS provider with ISO 27017 shows that this division is not only on paper, but has also been assessed.
Who is ISO 27017 for?
ISO 27017 is intended for two groups.
- Cloud providers. SaaS companies, hosting parties and platform providers. For them, ISO 27017 is a way to show customers that they take cloud risks seriously. See also ISO 27001 for SaaS companies.
- Cloud customers. Organisations that work heavily in the cloud. They use the customer side of ISO 27017 to set requirements for their providers, in line with control 5.23 on cloud services in Annex A.
How do you combine ISO 27017 with ISO 27001?
You first need an ISO 27001 ISMS. Then you include the ISO 27017 controls in your risk analysis and your Statement of Applicability. The certification body assesses them during the regular audit. The certificate or a separate statement then records that ISO 27017 has been included.
For example: a hosting company adds the cloud controls to its Statement of Applicability as extra lines, with a reference to the customer documentation that sets out the responsibilities. The auditor checks whether that documentation exists and whether the provider side of each line works.
What does the 2026 version mean?
ISO 27017:2026 has only been available since summer 2026. Certification bodies are still deciding how and when they will switch from the 2015 version. Ask your certification body which transition period they apply.
If you currently have an ISO 27017 statement based on 2015, ask your certification body about their plans. Use the switch to review your division of responsibilities again. The link with ISO 27002:2022 changes the numbers in your Statement of Applicability.
What the auditor wants to see for ISO 27017
- A documented division of responsibilities between you and your customers, and between you and your own cloud providers.
- Customer information about where data is stored, how back-ups work and what happens at the end of a contract.
- Separation of customer environments, with evidence from tests or configuration.
- Logging of administrator actions in customer environments.
- A working process for returning and deleting data.
Common mistakes with ISO 27017
- Thinking the underlying cloud party takes care of everything. If you run on a large cloud platform, the configuration remains your responsibility.
- Forgetting the customer side. ISO 27017 also asks that your customers know what they need to do.
- Announcing ISO 27017 without ISO 27001. Without an ISMS, there is no certificate to attach it to.
- Keeping old CLD numbers after the switch. Update your documents to the 2026 version.
Frequently asked questions about ISO 27017
Is ISO 27017 mandatory for cloud providers?
No. No law requires ISO 27017. Large customers and tenders sometimes ask for it, especially for hosting and platform services. For most SaaS companies, ISO 27001 is the first step, and ISO 27017 is an addition if customers ask for it.
What is the difference between ISO 27017 and control 5.23 in ISO 27001?
Control 5.23 in Annex A asks you to regulate how you buy, use, manage and end cloud services. That is the customer side, in a single control. ISO 27017 goes much further. It gives guidance for both customer and provider on a large part of the controls, plus additional cloud controls.
Do I need ISO 27017 if I run on a large cloud platform?
The large platforms often have ISO 27017 themselves for their own service. That covers their part. Your application, configuration and customer data fall under it if you are responsible for them. For that part, you can include ISO 27017 in your ISO 27001 scope yourself.
How much does ISO 27017 cost on top of ISO 27001?
The additional costs are mainly extra audit days and your own preparation. How much exactly depends on your scope and your certification body. Ask about it when you request a quote for ISO 27001. An overview of the basic costs is on ISO 27001 costs and timeline.
More information
- What is ISO 27002?: the basis on which ISO 27017 builds
- ISO 27018: personal data in the public cloud
- Supplier management: requirements for your own cloud providers
- SOC 2 for cloud providers: the American alternative