ISO/IEC 27017: cloud security controls, ready for audit
ISO/IEC 27017 is a code of practice for security controls in cloud services, for cloud providers and cloud customers alike. It is usually assessed alongside an ISO/IEC 27001 certification, not on its own. We prepare you; an accredited certification body audits you.
Who it is for
Cloud and software-as-a-service providers, and organisations that run key systems in the cloud, often because clients or tenders ask. IT and security leads get each cloud control assigned to a clear owner: your team or your provider.
Who does what
- You
You name a project lead, list your cloud services and run the agreed controls.
- Us: we prepare you
We prepare you: cloud scope, shared duties, controls, evidence and a readiness review.
- Independent body: audits and certifies
An accredited certification body assesses you, usually within your ISO/IEC 27001 audit.
What drives the time and the effort
- Whether you provide cloud services, use them, or both
- How many cloud accounts, applications and providers are in scope
- Whether an ISO/IEC 27001 system is already in place
- How clearly your contracts split security duties with each provider
- The certification body’s audit fee, charged by that body
ISO/IEC 27017:2026, the second edition, was published in July 2026 and replaces the 2015 edition. ISO.
Common questions
What is ISO/IEC 27017?
A code of practice published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It adds cloud-specific guidance and controls to ISO/IEC 27002, for cloud providers and cloud customers.
Can you be certified to ISO/IEC 27017 on its own?
Usually not. ISO/IEC 27017 is guidance, not a management system standard. Organisations are normally assessed against it alongside an ISO/IEC 27001 certification, by an accredited certification body that extends the audit to the cloud controls.
Do we need it if we only use cloud services?
Not always. The standard guides cloud customers as well as providers. If clients mainly ask how you secure your cloud services, building its controls into your ISO/IEC 27001 system may be enough. We advise at scoping.
How much does ISO/IEC 27017 cost?
Two parts: our preparation, for which you get a fixed-fee proposal after a short scoping call, and the certification body’s audit fee. Scope and existing ISO/IEC 27001 controls drive both. Government grants may cover part of the cost. We check at your first call. Tell us your scope in 5 minutes and you get a fixed-fee proposal within 2 working days: Scope your project
Which edition of ISO/IEC 27017 applies?
The 2026 edition replaced the 2015 edition in July 2026. If you already work to the 2015 edition, ask your certification body about its transition timing. We map your controls to the new edition.
ISO work is led by a practising lead auditor, certified through IRCA or PECB.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)