ISO/IEC 27017 — Cloud Security Controls Code of Practice
- ClassificationCategoryCloud SecurityDomainCloud SecurityFramework FamilyISO 27000 Series
- Regulatory ContextTypeStandardLegal InstrumentStandardSectorTechnology SectorIndustryCloud & Technology Providers
- Region / PublisherRegionGlobalRegion DetailInternationalPublisherInternational Organization for Standardization (ISO) and International Electrotechnical Commission (IEC)
- VersioningVersionSecond edition (ISO/IEC 27017:2026; replaces ISO/IEC 27017:2015)Effective DateJuly 2026Issue DateJuly 2026 (second edition; ISO publication stage July 27, 2026)
- AdoptionAdoption ModelVoluntaryImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
ISO/IEC 27017:2026 is a paid standard sold by ISO and national standards bodies, and the text is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- ISO/IEC 27017 gives information security control guidance for providing and using cloud services, addressed to both customers and providers.
- The second edition, ISO/IEC 27017:2026, was published July 2026 and replaced the 2015 edition, which ISO withdrew the same date.
- It is built on ISO/IEC 27002:2022 and adds four cloud-specific controls, marked CLD, on shared roles, partner agreements, virtual segregation, and unauthorized cloud use.
- It is guidance, not a set of certifiable requirements, and applies to all cloud deployment models, including private cloud.
- SmartSuite Third Party Risk Management assesses cloud providers, and Compliance Management holds the split of customer and provider responsibilities with evidence.
Overview
ISO/IEC 27017 is the international standard that gives information security control guidance for providing and using cloud services, based on ISO/IEC 27002 and addressed to both cloud service customers (CSCs) and cloud service providers (CSPs). The current edition is ISO/IEC 27017:2026, the second edition, published in July 2026 (ISO's publication stage was reached on July 27, 2026); it was prepared by ISO/IEC JTC 1/SC 27 in collaboration with ITU-T (as Rec. ITU-T X.1631) and cancels and replaces the 2015 first edition, which ISO withdrew on the same date.
The 2026 edition is built on ISO/IEC 27002:2022. Clauses 5 to 8 follow the control numbering of that standard (organizational, people, physical and technological controls) and add four controls that relate only to cloud services, marked CLD: 5.38 shared roles and responsibilities within a cloud computing environment, 5.39 agreement on the roles and responsibilities of the cloud service partner, 8.35 segregation in virtual computing environments and 8.36 detection and prevention of unauthorized use of cloud services.
It is guidance, not a set of certifiable requirements. The Introduction says the controls and the extent of the guidance an organization uses depend on its risk assessment and on legal, regulatory, contractual or other cloud-specific requirements, and Clause 1 says it applies to all cloud deployment models, including private cloud.
Why does it matter?
Cloud security is split between two parties, and ISO/IEC 27017 is the standard that says who does what. The Introduction explains that some guidance is for CSCs that implement controls and some is for CSPs that support the implementation of those controls, so a customer and a provider can read the same control and see their own part of it.
Key benefits include:
- Responsibilities are named
Control 5.38 covers shared roles and responsibilities within a cloud computing environment, and 5.39 covers agreeing the roles and responsibilities of the cloud service partner.
- Supplier relationships are cloud-aware
Clause 4.3.1 explains supplier relationships in cloud services, and the supplier controls 5.19 to 5.23, including information security for use of cloud services (5.23), are covered in Clause 5.
- Four cloud-only controls
5.38, 5.39, 8.35 and 8.36 address matters that exist only in cloud services, such as segregation in virtual computing environments and detection of unauthorized use.
- Monitoring is addressed
Annex B (informative) covers monitoring of cloud services, alongside the logging (8.15) and monitoring activities (8.16) controls.
- It fits an ISMS
Because the clauses follow ISO/IEC 27002:2022 (Clause 4.1), controls chosen in an ISO/IEC 27001 ISMS can pick up their cloud guidance without a separate catalog.
How does it work?
Clauses 1 to 4 set the frame: scope (1), normative references (2, ISO/IEC 22123-1 cloud computing vocabulary and ISO/IEC 27002:2022), terms, definitions and abbreviated terms (3) and guidance for using the document (4). Clause 4.1 explains the relation to ISO/IEC 27002:2022, 4.2 the structure, and 4.3 the cloud-specific concepts: supplier relationships in cloud services (4.3.1), relationships between CSCs and CSPs (4.3.2) and managing information security risks in cloud services (4.3.3).
Clauses 5 to 8 then list the controls in the order of ISO/IEC 27002:2022: organizational controls 5.1 to 5.37, people controls 6.1 to 6.8, physical controls 7.1 to 7.14 and technological controls 8.1 to 8.34, with the CLD controls added as 5.38, 5.39, 8.35 and 8.36. A CSC reads each control as something to implement for the cloud services it uses; a CSP reads it as something to implement in providing the service and to support for its customers.
The 2026 edition changed the title and scope, presents controls with a simple taxonomy and associated attributes, and merged some controls, removed some and introduced several (Foreword). Annex A is a correspondence table with the 2015 edition. That first edition took the clauses 5 to 18 of ISO/IEC 27002:2013, added cloud sector-specific guidance to them, and placed its extended control set in an Annex A of its own.
Key Elements
- Cloud-specific concepts (Clause 4.3)
Supplier relationships in cloud services, relationships between CSCs and CSPs, and managing information security risks in cloud services.
- Organizational controls (Clause 5)
5.1 to 5.37, including threat intelligence (5.7), supplier relationships (5.19 to 5.22), use of cloud services (5.23) and ICT readiness for business continuity (5.30), plus CLD controls 5.38 and 5.39.
- People controls (Clause 6)
6.1 to 6.8, from screening to information security event reporting, including remote working (6.7).
- Physical controls (Clause 7)
7.1 to 7.14, from physical security perimeters to secure disposal or re-use of equipment.
- Technological controls (Clause 8)
8.1 to 8.34, including configuration management (8.9), information deletion (8.10), logging (8.15), monitoring activities (8.16) and network security (8.20), plus CLD controls 8.35 and 8.36.
- Shared roles and agreements (5.38 and 5.39)
Roles and responsibilities within a cloud computing environment are shared between customer and provider and agreed with the cloud service partner.
- Virtual environments and misuse (8.35 and 8.36)
Segregation in virtual computing environments, and detection and prevention of unauthorized use of cloud services.
- Annexes A and B (informative)
A: correspondence between this document and the first edition (ISO/IEC 27017:2015). B: monitoring of cloud services.
What does it cover?
Clause 1 says the document provides guidance for information security controls, based on ISO/IEC 27002, applicable to the provision and use of cloud services. It provides additional guidance for relevant controls in ISO/IEC 27002:2022 and additional controls with guidance that relate specifically to cloud services, for both CSCs and CSPs. It is considered a horizontal document, a foundation and common understanding of security for the provision and use of cloud services, and it applies to all cloud deployment models including private cloud, where adjustments can be needed for relationships between an organization's internal departments.
What are its objectives?
Clause 1 and the Introduction set out the purposes:
To give guidance for information security controls, based on ISO/IEC 27002, for the provision and use of cloud services (Clause 1).
To add guidance for the relevant controls of ISO/IEC 27002:2022 (Clause 1).
To add controls with guidance that relate specifically to cloud services (Clause 1).
To serve both CSCs and CSPs, with some guidance for those who implement controls and some for those who support them (Introduction).
To align with and complement the guidance in ISO/IEC 27002 (Introduction).
Framework in Context
ISO/IEC 27002:2022 is the base document, and the Introduction of that standard names ISO/IEC 27017 as the sector standard for cloud services (0.7). ISO/IEC 27017:2026 was prepared by ISO/IEC JTC 1/SC 27 in collaboration with ITU-T and with CEN/CLC/JTC 13 under the Vienna Agreement, and CEN adopted it as EN ISO/IEC 27017:2026, superseding the 2021 European edition and due to be given national standard status by February 2027. ISO's records show the 2015 edition as withdrawn and replaced by the 2026 edition. ISO/IEC 27001 certification is of an ISMS; an organization can draw cloud controls from this document when it determines controls under Clause 6.1.3 of that standard.
Common Framework Mappings
ISO/IEC 27017 is commonly mapped to the ISMS, privacy and cloud control frameworks that share its control base, so one set of cloud evidence can serve several programs.
Mapped frameworks include:
CSA CCM v4
CIS Controls v8.1
ISO 27001:2022
ISO 27002:2022
ISO 27005:2022
ISO 27018
ISO 27701
NIST 800-53 Rev.5
How SmartSuite Supports ISO/IEC 27017
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Third Party Risk Management to assess and monitor the cloud providers an organization depends on, Compliance Management to hold the controls and the split between customer and provider responsibilities as requirements with evidence, and Cyber & IT Risk for the cloud risks and the controls that treat them.
Cloud Provider Register
Use Third Party Risk Management to record each cloud service with its owner, assessment and review dates (Clause 4.3.1 and controls 5.19 to 5.23).
Shared Responsibility Matrix
Record in Compliance Management which control belongs to the customer, which to the provider, and who agreed it (controls 5.38 and 5.39).
Cloud Control Library
Hold the controls of Clauses 5 to 8, including the four CLD controls, with owners, applicability and implementation status.
Cloud Risk Register
Use Cyber & IT Risk to link cloud risks to the controls chosen to treat them (Clause 4.3.3).
Monitoring and Evidence
Attach logs, monitoring reports and provider evidence to the controls they support (8.15, 8.16 and Annex B).
Edition Crosswalk
Keep the Annex A correspondence beside each record so teams moving from the 2015 edition can see how its controls map.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
ISO/IEC 27018:2025 gives guidelines for protecting PII in public clouds acting as PII processors, built on ISO/IEC 27002:2022 with an extended control set.
Frequently Asked Questions For ISO/IEC 27017 (Cloud Security Controls Code of Practice)
No. ISO's records show the 2015 first edition as withdrawn on July 27, 2026 and replaced by ISO/IEC 27017:2026, the second edition, which cancels and replaces it (Foreword). The 2026 edition is based on ISO/IEC 27002:2022 rather than the 2013 edition.
Four controls marked CLD: 5.38 shared roles and responsibilities within a cloud computing environment, 5.39 agreement on the roles and responsibilities of the cloud service partner, 8.35 segregation in virtual computing environments, and 8.36 detection and prevention of unauthorized use of cloud services. Clauses 5 to 8 otherwise follow the controls of ISO/IEC 27002:2022.
Both. Clause 1 says it provides controls and guidance for cloud service customers and cloud service providers, and the Introduction says some guidance is for customers who implement the controls and some for providers who support their implementation. It also applies to private cloud (Clause 1, Note).
It is guidance on controls and has no management system requirements of its own. Certification is of an ISMS under ISO/IEC 27001, and an organization can take controls from any source when it determines them under Clause 6.1.3 b, so ISO/IEC 27017 can supply the cloud controls in the Statement of Applicability.
The Foreword lists three main changes: the title and scope were modified, the structure now presents controls with a simple taxonomy and attributes, and some controls were merged, some removed and several introduced. Annex A of the 2026 edition gives the correspondence with the first edition.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.