Continuity & Cloud · Framework
ISO/IEC 27017:2026, the cloud security controls
Cloud-specific security guidance for both cloud customers and cloud providers.
- Type
- Framework
- Group
- Continuity & Cloud
- We help with
- Cloud Infrastructure
- Issued by
- No certificate issued
What it is.
ISO/IEC 27017:2026 gives guidance on information security controls for cloud services, based on ISO/IEC 27002:2022. It replaced the 2015 edition in July 2026. It covers both cloud customers and cloud service providers and, as guidance rather than a requirements standard, is assessed within an ISO/IEC 27001 certification audit.
Who usually needs it
- SaaS and cloud service providers
- Organisations running significant workloads on AWS or Microsoft Azure
- Firms whose clients ask about cloud security
What it covers.
- 01
Shared responsibility
Clarifies which controls sit with the customer and which with the provider.
- 02
Cloud-specific controls
Guidance on areas such as virtual environments, administrator operations and customer data separation.
- 03
Alongside ISO/IEC 27001
Assessed within an ISO/IEC 27001 certification audit, as part of the ISMS scope.
How we help with ISO/IEC 27017
ISO/IEC 27017 is applied inside an ISO/IEC 27001 ISMS rather than certified on its own. We work out which cloud responsibilities sit with you and which with AWS, Azure or your SaaS providers, then add the cloud-specific controls, such as virtual network segregation and admin operation logging, to your Statement of Applicability with evidence from your own tenants.
No. It is guidance, assessed within an ISO/IEC 27001 certification audit as part of the ISMS scope.
Yes. It has guidance for cloud customers as well as providers.
ISO/IEC 27017 is guidance, not a requirements standard, so it is assessed as part of an ISO/IEC 27001 certification audit by an accredited certification body. ITCCS prepares you for that audit.
Let's build what's next.
Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.
- Response
- Usually within one business day
- Location
- Worldwide
What happens next
- 01
Reply
- 02
Discovery call
- 03
Proposal
This page is general guidance, not legal advice. Last reviewed October 2026.