ISO & IEC / Guidance
ISO/IEC 27017:2026 Security across the cloud boundary
ISO/IEC 27017 adds cloud-specific direction for security controls used by cloud service customers and providers. It is especially useful where responsibility for access, infrastructure, monitoring or response is divided between parties.
The place in the system
Where it fits
Use it to adapt ISO/IEC 27002-based controls to cloud services within a risk-led ISO/IEC 27001 programme.
Practical interpretation
How to use this reference
These are editorial starting points, not copied requirements or an implementation checklist from the standard.
Questions and actions
- Map each cloud control to the party that can actually perform it.
- Review contractual and technical evidence for shared responsibilities.
- Recheck ownership when services or deployment models change.
Evidence to look for
- Customer-provider responsibility map
- Cloud security configuration review
- Supplier service commitment record
Illustrative example
What it could look like
An application team assumes its provider handles every backup and log retention decision. A cloud responsibility review reveals which tasks remain with the customer and assigns those tasks to named owners.
Boundary to keep clear
Cloud guidance does not make a provider's 27001 certificate cover every customer configuration or every use of the service.
Source and edition check
Open the official record
Research checked 2026-10-20. Catalogue status and edition can change; the official publisher record controls. Full standard text is not reproduced here.