A cloud-security guide for aligning provider and customer responsibilities, evidence, account settings, incident handling and service exit.
Scope and use
ISO/IEC 27017:2026 provides cloud-security controls and guidance based on ISO/IEC 27002. It complements information-security management; it does not replace ISO/IEC 27001 requirements or the cloud contract.
Key requirements
- Map each cloud service, data class, administrator and operational responsibility across provider and customer.
- Review identity, privileged access, configuration, segregation, change control, incident response and backup responsibilities.
Implementation outline
- Map each cloud service, data class, administrator and operational responsibility across provider and customer.
- Review identity, privileged access, configuration, segregation, change control, incident response and backup responsibilities.
- Check supplier evidence and service commitments, define escalation paths, and plan data return, deletion and continuity at exit.
- Inventory services; assign shared controls; verify configuration and evidence; test incident and recovery arrangements; review suppliers and changes.