ISO/IEC 27017 is the international code of practice for information security controls in cloud services. Published December 2015, it extends ISO/IEC 27002 with cloud-specific implementation guidance and adds seven cloud-only controls. It applies to both cloud service providers and cloud customers, and certification is layered on top of an existing ISO 27001 audit.
What does ISO 27017 add on top of 27001?
The standard adds cloud-specific guidance to 27002 controls plus seven cloud-only controls covering shared roles and virtual environments.
The seven cloud-only controls cover shared roles between provider and customer, removal of customer assets, segregation in virtual environments, virtual-machine hardening, administrator operational security, monitoring of cloud services, and alignment of virtual and physical network security (ISO).
Who certifies against ISO 27017 and when?
A 27017 audit is run by the same accredited body that issues a vendor's ISO 27001 certificate, usually as a single combined assessment.
The certificate names 27017 alongside ISO 27001 on the same scope statement. AWS, Azure, Google Cloud, and Salesforce all carry combined 27001 + 27017 + 27018 certificates, which is the de facto template for any multi-tenant SaaS selling into European or Japanese buyers.
Why does ISO 27017 show up in cloud questionnaires?
European and Japanese buyers treat 27017 as the cloud half of the answer to the CAIQ, and US buyers ask for it alongside SOC 2 for SaaS scope.
The standard is being revised: ISO/IEC FDIS 27017 is in the final draft stage and expected to publish in 2026, retitled to align with the 27002:2022 themes (ISO). Most teams holding a 27017:2015 certificate will roll the transition into their next 27001:2022 surveillance audit, the same way the CAIQ and SOC 2 prep usually rides along.
Related terms
These adjacent terms cover the base ISMS, the privacy companion in the 27000 series, and the questionnaires that travel with a 27017 certificate.
- ISO 27001 - the base ISMS standard 27017 layers cloud guidance on top of
- ISO 27018 - the PII-processor companion most cloud vendors carry alongside 27017
- CAIQ - the cloud questionnaire whose CCM controls map cleanly onto 27017 evidence
- TPRM - the vendor-risk motion in which a combined 27001 + 27017 certificate is exchanged