ISO 27017:2026

Requirements and controls

• 5 Organization-level controls

  • 5.1 Security policies and topic-specific policies

    The security policy set covers cloud computing: as a cloud customer the organization states how cloud services may be used, and as a provider it defines the security rules its service follows for tenants.

    • Security Governance Program
    • Information Security & Privacy Policies
    • Management Review of Policies
    • Periodic Policy Acknowledgement
    • Shared Responsibility Model

  • 5.2 Security roles and duties

    Security responsibilities for using or providing cloud services are defined, assigned to named roles and made known to the people who hold them.

    • Assigned Security & Privacy Responsibilities
    • Roles & Responsibilities
    • Cybersecurity Responsibilities
    • Compliance Program Manager
    • People Operations Owner
    • Shared Responsibility Model

  • 5.3 Separating conflicting duties

    Conflicting duties are split in cloud administration as elsewhere, so no single administrator can both make and approve a sensitive change.

    • Segregation of Duties
    • Organizational Structure
    • Roles & Responsibilities

  • 5.4 Management's security responsibilities

    Managers require the staff and contractors who administer or use cloud services to follow the organization's security policies and procedures.

    • Security & Privacy Program Review
    • Periodic Policy Acknowledgement
    • New Hire Security & Privacy Training
    • Periodic Security & Privacy Training

  • 5.5 Liaison with authorities

    The organization knows which authorities have jurisdiction over its cloud services and the data in them, including where its providers operate, and keeps a way to reach them.

    • Cybersecurity Responsibilities

  • 5.6 Liaison with specialist security groups

    The organization follows cloud security forums and specialist groups to keep up with cloud-specific threats and good practice.

    • Cybersecurity Responsibilities

  • 5.7 Threat intelligence gathering

    Threat information relevant to the cloud platforms the organization uses or offers is collected, analyzed and turned into protective action.

    • Anomalous Behavior Detection
    • Centralized Security Logging
    • Vulnerability Remediation Process
    • Incident Management Policy & Procedure

  • 5.8 Security in projects

    Projects that adopt or change cloud services consider security from the start, including how responsibilities are split with the provider.

    • Risk Assessment
    • Change Management Policy & Procedure
    • Approval of Changes
    • Shared Responsibility Model

  • 5.9 Asset and information inventory

    The inventory covers assets held in the cloud, such as accounts, virtual machines, storage and customer data, and names an owner for each.

    • Inventory of Infrastructure Assets
    • Inventory of Endpoint Assets
    • Asset Inventory Updates
    • Asset Ownership Assignment

  • 5.10 Rules for acceptable use of assets

    Acceptable use rules extend to cloud resources and the data they hold, and customers know what use of the service is permitted.

    • Rules of Behavior
    • Endpoint Security Policy

  • 5.11 Returning assets

    When a cloud service ends, customer data and other assets are returned or removed on agreed terms, and the provider documents how and when that happens.

    • Human Resources Policy & Procedure
    • Inventory of Endpoint Assets
    • Data Retention Policy
    • Contractual Obligations Register

  • 5.12 Information classification

    Information placed in cloud services is classified, and the classification decides which services and safeguards may be used for it.

    • Data Classification Policy
    • Data Classification Labels

  • 5.13 Information labels

    Classification labels are applied to data and resources held in cloud services so that handling rules remain visible.

    • Data Classification Labels
    • Data Classification Policy

  • 5.14 Transferring information

    Data moving to, from or between cloud services is protected in transit and covered by agreed transfer rules.

    • Transmission Confidentiality
    • Network Security Policy & Procedure
    • Third-Party Criticality Assessments

  • 5.15 Access control rules

    Access rules cover cloud consoles, APIs and stored data, and the provider's access features are used to enforce them.

    • Access Control Policy & Procedure
    • Identity Validation
    • Production Database Access Restriction

  • 5.16 Managing identities

    Identities used with cloud services, including administrator and service accounts, are created, changed and removed through a controlled process.

    • Identity Validation
    • User Access Reviews
    • Termination of Employment

  • 5.17 Managing authentication secrets

    Passwords, keys and other secrets used to reach cloud services are issued, stored and rotated securely.

    • Password Management Guidelines
    • Multi-Factor Authentication
    • Access Control Policy & Procedure

  • 5.18 Granting and reviewing access rights

    Access rights to cloud services are granted by role, reviewed periodically and withdrawn when no longer needed, using the provider's access management functions.

    • Access Control Policy & Procedure
    • Identity Validation
    • User Privilege Reviews
    • User Access Reviews
    • Production System Access Review
    • Termination of Employment

  • 5.19 Supplier security

    Cloud providers are managed as suppliers: their security is assessed before adoption and kept under review for the life of the relationship.

    • Vendor Management Policy & Procedure
    • Third-Party Criticality Assessments
    • Management Review of Third-Party Risks

  • 5.20 Security terms in supplier agreements

    Agreements with cloud providers record security commitments, the split of responsibilities, service levels, data location and how data is handed back at exit.

    • Vendor Management Policy & Procedure
    • Third-Party Criticality Assessments
    • Subservice Organization Evaluation
    • Contractual Obligations Register
    • Shared Responsibility Model

  • 5.21 ICT supply chain security

    Security expectations flow down the cloud supply chain, including to the providers that a cloud service itself depends on.

    • Vendor Management Policy & Procedure
    • Third-Party Criticality Assessments
    • Subservice Organization Evaluation
    • Management Review of Third-Party Risks

  • 5.22 Supplier service monitoring and change

    The organization monitors its cloud providers against their commitments and assesses the impact of service changes they announce.

    • Management Review of Third-Party Risks
    • Third-Party Criticality Assessments
    • Subservice Organization Evaluation

  • 5.23 Security of cloud service use

    The organization governs how cloud services are chosen, used, operated and exited so they meet its security requirements.

    • Vendor Management Policy & Procedure
    • Shared Responsibility Model
    • Subservice Organization Evaluation
    • Third-Party Criticality Assessments

  • 5.24 Incident response planning

    Customer and provider agree in advance who does what during an incident, including how each side reports events that affect the cloud service.

    • Incident Management Policy & Procedure
    • Incident Tracking
    • Automated Incident Reporting
    • Incident Reporting Assistance
    • Shared Responsibility Model

  • 5.25 Triage of security events

    Security events in cloud services are assessed to decide whether they are incidents, drawing on information from both the organization and its provider.

    • Incident Management Policy & Procedure
    • Incident Tracking

  • 5.26 Responding to incidents

    Incidents involving cloud services are contained and resolved under agreed procedures, with customer and provider coordinating where needed.

    • Incident Management Policy & Procedure
    • Incident Tracking
    • Breach Risk Assessment & Notification

  • 5.27 Lessons from incidents

    Lessons from cloud-related incidents are used to strengthen controls on both sides of the shared responsibility split.

    • Incident Management Policy & Procedure
    • Incident Tracking
    • Security & Privacy Program Review

  • 5.28 Evidence collection

    Logs, snapshots and other evidence about incidents in cloud environments can be collected and preserved, including from the provider when required.

    • Incident Management Policy & Procedure
    • Centralized Security Logging

  • 5.29 Security during disruption

    Security is maintained while cloud services are disrupted, for example during failover between regions or providers.

    • Business Continuity Policy & Procedure
    • Disaster Recovery Policy
    • Disaster Recovery Testing

  • 5.30 ICT readiness for continuity

    Cloud service levels, backup and failover capabilities are checked against the organization's recovery time and recovery point objectives.

    • Disaster Recovery Policy
    • Business Continuity Policy & Procedure
    • Disaster Recovery Testing
    • Backup Restoration Testing

  • 5.31 Legal, regulatory and contractual obligations

    Laws and contract terms that apply to cloud processing, including the jurisdictions where data is stored, are identified and met.

    • Data Governance
    • Statutory, Regulatory & Contractual Compliance
    • Contractual Obligations Register
    • Cross-Border Data Transfers

  • 5.32 Intellectual property

    Software licences and other intellectual property are respected when software runs in, or is delivered as, a cloud service.

    • Statutory, Regulatory & Contractual Compliance

  • 5.33 Protecting records

    Records kept in cloud services are protected against loss, tampering and unauthorized access for their full retention period.

    • Policy Documentation Retention
    • Data Retention Policy
    • Statutory, Regulatory & Contractual Compliance

  • 5.34 Privacy and PII obligations

    Personal data processed in cloud services is protected in line with privacy law and contractual commitments.

    • Data Protection Policy & Procedure
    • Privacy Officer
    • Privacy by Design Policy
    • Personal Data Inventory

  • 5.35 Independent security review

    Cloud security arrangements are reviewed independently, and providers back their claims with independent audit reports or certifications.

    • Internal Audit
    • Security & Privacy Program Review
    • Penetration Testing
    • Subservice Organization Evaluation

  • 5.36 Conformance with security policies

    Compliance with the security rules for using and providing cloud services is checked regularly.

    • Internal Audit
    • Management Review of Policies
    • Statutory, Regulatory & Contractual Compliance

  • 5.37 Written operating procedures

    Procedures for administering cloud services, especially operations that are risky or hard to undo, are written down and available to the people who perform them.

    • Information Security & Privacy Policies
    • ISMS Manual
    • Change Management Policy & Procedure
    • Data Backup Policy
    • Deployment Notifications

  • 5.38 Shared cloud security responsibilities

    Customer and provider identify, document, communicate and carry out their respective security responsibilities for the cloud service.

    • Shared Responsibility Model
    • Contractual Obligations Register
    • Subservice Organization Evaluation

  • 5.39 Cloud service partner responsibilities

    When a cloud service partner such as a broker, integrator or auditor is involved, its security roles and responsibilities are agreed with the customer and the provider.

    • Shared Responsibility Model
    • Contractual Obligations Register
    • Vendor Management Policy & Procedure
    • Third-Party Criticality Assessments

• 6 Controls for people

  • 6.1 Background screening

    People who administer cloud services or can reach customer data are screened in proportion to the sensitivity of that access.

    • Personnel Screening
    • Competency Screening

  • 6.2 Employment terms

    Employment terms make cloud-related security duties, including protecting customer data, part of each person's obligations.

    • Code of Business Conduct
    • New Hire Policy Acknowledgement
    • Human Resources Policy & Procedure
    • Roles & Responsibilities

  • 6.3 Security awareness and training

    Staff are trained on the secure use or administration of the cloud services that relate to their roles.

    • Security & Privacy Awareness
    • New Hire Security & Privacy Training
    • Periodic Security & Privacy Training

  • 6.4 Disciplinary action for breaches

    Breaches of cloud security rules are handled through the formal disciplinary process.

    • Code of Business Conduct
    • Human Resources Policy & Procedure

  • 6.5 Duties after leaving or changing role

    Cloud access and duties are adjusted or removed when someone leaves or changes role, and confidentiality obligations continue afterwards.

    • Human Resources Policy & Procedure
    • Termination of Employment

  • 6.6 Confidentiality agreements

    Confidentiality agreements cover information held in, or learned through, cloud services.

    • New Hire Policy Acknowledgement
    • Periodic Policy Acknowledgement
    • Contractual Obligations Register

  • 6.7 Remote work security

    People who reach cloud services from outside the office do so from protected devices and connections.

    • Endpoint Security Policy
    • Endpoint Encryption
    • Multi-Factor Authentication
    • Session Lock
    • Malware Protection

  • 6.8 Reporting security events

    Staff, customers and providers have channels to report security events affecting cloud services quickly.

    • Automated Incident Reporting
    • Incident Reporting Assistance
    • Incident Management Policy & Procedure

• 7 Controls for premises and equipment

  • 7.1 Physical perimeters

    Facilities hosting cloud services have defined secure perimeters; customers rely on provider assurance for data center perimeters.

    • Physical Protection Policy & Procedure

  • 7.2 Controlled physical entry

    Entry to areas housing cloud infrastructure is limited to authorized people.

    • Physical Protection Policy & Procedure

  • 7.3 Securing offices and facilities

    Offices and rooms used to manage cloud services are physically secured.

    • Physical Protection Policy & Procedure

  • 7.4 Monitoring of premises

    Premises that host cloud infrastructure are watched for unauthorized physical access.

    • Physical Protection Policy & Procedure
    • Subservice Organization Evaluation

  • 7.5 Physical and environmental threats

    Cloud infrastructure is protected against fire, flood, power loss and other physical or environmental hazards.

    • Physical Protection Policy & Procedure
    • Business Continuity Policy & Procedure
    • Disaster Recovery Policy

  • 7.6 Work in secure areas

    Rules govern work inside secure areas where cloud infrastructure is located.

    • Physical Protection Policy & Procedure

  • 7.7 Clearing desks and screens

    Desks and screens used to administer cloud services are kept free of exposed sensitive information.

    • Clear Desk & Clear Screen
    • Session Lock

  • 7.8 Equipment placement and protection

    Equipment supporting cloud services is placed and protected to reduce physical risk.

    • Physical Protection Policy & Procedure
    • Endpoint Security Policy

  • 7.9 Assets used off-site

    Devices used to administer cloud services away from the office are protected.

    • Endpoint Security Policy
    • Endpoint Encryption
    • Inventory of Endpoint Assets
    • Malware Protection

  • 7.10 Storage media handling

    Storage media holding cloud data are tracked through their life and sanitized before reuse or disposal.

    • Media Disposal Policy
    • Endpoint Encryption
    • Data Classification Policy

  • 7.11 Utility services

    Power and other utilities that cloud infrastructure depends on are protected against failure.

    • Physical Protection Policy & Procedure
    • Subservice Organization Evaluation

  • 7.12 Cabling protection

    Power and data cabling for cloud infrastructure is protected against interception and damage.

    • Physical Protection Policy & Procedure
    • Subservice Organization Evaluation

  • 7.13 Maintaining equipment

    Cloud infrastructure equipment is maintained so that it stays available and secure.

    • Endpoint Security Validation
    • Endpoint Security Policy

  • 7.14 Disposal and reuse of equipment

    Equipment that held cloud data is wiped or destroyed securely before it is disposed of or reused.

    • Media Disposal Policy

• 8 Technology controls

  • 8.1 Endpoint devices

    Devices used to reach or administer cloud services meet the organization's endpoint security baseline.

    • Endpoint Security Policy
    • Malware Protection
    • Endpoint Security Validation
    • Endpoint Encryption
    • Session Lock

  • 8.2 Privileged access

    Privileged access to cloud management interfaces is kept to a minimum, strongly authenticated and reviewed.

    • Production Database Access Restriction
    • User Privilege Reviews
    • Multi-Factor Authentication
    • Access Control Policy & Procedure

  • 8.3 Restricting access to information

    Access to data held in cloud services is restricted to what each role needs, using the access controls the service offers.

    • Access Control Policy & Procedure
    • Identity Validation
    • Production Database Access Restriction
    • User Access Reviews

  • 8.4 Source code access

    Access to source code and infrastructure-as-code stored in cloud repositories is controlled.

    • Identity Validation
    • User Privilege Reviews
    • Secure System Modification
    • Approval of Changes

  • 8.5 Authentication mechanisms

    Cloud services are reached through strong authentication, with multi-factor authentication for administrators.

    • Multi-Factor Authentication
    • Password Management Guidelines
    • Cloud Console Session Timeout

  • 8.6 Capacity planning

    Cloud resource usage is monitored and planned so services keep up with demand.

    • Capacity & Performance Management
    • Impact Analysis

  • 8.7 Malware protection

    Malware protection covers cloud workloads and the endpoints used to reach them.

    • Malware Protection

  • 8.8 Technical vulnerability management

    Vulnerabilities in cloud workloads and services are found and fixed, with remediation duties split according to the service model.

    • Vulnerability Remediation Process
    • Centralized Flaw Remediation
    • Penetration Testing
    • Vulnerability Management Policy & Procedure

  • 8.9 Secure configuration

    Cloud resources follow secure configuration baselines, and configuration drift is detected and corrected.

    • External System Connections
    • Endpoint Security Validation
    • Endpoint Security Policy
    • Impact Analysis

  • 8.10 Deleting information

    Data held in cloud services is deleted when no longer needed, and the provider confirms deletion of customer data when the service ends.

    • Data Retention Policy
    • Media Disposal Policy

  • 8.11 Masking data

    Sensitive data in cloud services is masked or pseudonymized where the risk calls for it.

    • Test Data Protection
    • Data Classification Policy
    • Encryption Policy & Procedure

  • 8.12 Preventing data leakage

    Measures detect and prevent unauthorized disclosure of data out of cloud services.

    • Data Classification Policy
    • Transmission Confidentiality
    • Endpoint Encryption
    • Encryption of Data at Rest

  • 8.13 Backups

    Backups of cloud data are taken, protected and tested, and the backup duties of customer and provider are clearly divided.

    • Data Backup Policy
    • Data Backups
    • Backup Restoration Testing

  • 8.14 Redundant processing facilities

    Cloud services are deployed with enough redundancy, such as several zones or regions, to meet availability needs.

    • Data Backups
    • Business Continuity Policy & Procedure
    • Disaster Recovery Policy

  • 8.15 Logging activity

    Activity in cloud services is logged, and customers can obtain the logs they need to investigate events.

    • Centralized Security Logging
    • Anomalous Behavior Detection

  • 8.16 Monitoring for anomalies

    Cloud services are monitored for anomalous behavior, and customers have the means to monitor their own use of the service.

    • Anomalous Behavior Detection
    • Centralized Security Logging
    • Capacity & Performance Management
    • Unauthorized Activity Monitoring

  • 8.17 Time synchronization

    Clocks across cloud and on-premises systems are synchronized so log timestamps can be correlated.

    • Clock Synchronization

  • 8.18 Powerful utility programs

    Utility programs that can override cloud system controls are restricted and their use is monitored.

    • User Privilege Reviews
    • Production Database Access Restriction

  • 8.19 Software installation on production systems

    Software installation on cloud workloads is controlled.

    • Approval of Changes
    • Endpoint Security Policy
    • Rules of Behavior

  • 8.20 Network protection

    Virtual and physical networks supporting cloud services are protected and managed under consistent security rules.

    • External System Connections
    • Limit Network Connections
    • Network Security Policy & Procedure
    • Transmission Confidentiality

  • 8.21 Network service security

    The security features and service levels of cloud network services are identified and monitored.

    • External System Connections
    • Network Security Policy & Procedure
    • Network & Data Flow Diagrams
    • Subservice Organization Evaluation

  • 8.22 Network segmentation

    Cloud networks are segmented, for example between tenants, environments and administrative interfaces.

    • Limit Network Connections
    • External System Connections
    • Network Security Policy & Procedure
    • Network & Data Flow Diagrams

  • 8.23 Filtering web access

    Web access from cloud workloads and administrator devices is filtered to reduce exposure to malicious content.

    • Malware Protection
    • Endpoint Security Policy

  • 8.24 Cryptography

    Data in cloud services is encrypted where needed, and it is clear whether the customer or the provider manages each key.

    • Encryption Policy & Procedure
    • Encryption of Data at Rest
    • Transmission Confidentiality
    • Endpoint Encryption

  • 8.25 Secure development process

    Cloud services, and applications built on them, are developed under a secure development process.

    • Change Management Policy & Procedure
    • Secure System Modification
    • Approval of Changes

  • 8.26 Security requirements for applications

    Security requirements for applications hosted in or offered as cloud services are identified and specified.

    • Change Management Policy & Procedure
    • Input Range Validation
    • Mandatory Field Validation
    • Vulnerability Remediation Process

  • 8.27 Secure architecture and engineering

    Cloud architectures are designed on secure engineering principles such as least privilege and defense in depth.

    • Change Management Policy & Procedure
    • Network & Data Flow Diagrams
    • Privacy by Design Policy

  • 8.28 Secure coding practices

    Code deployed to cloud services follows secure coding practices.

    • Change Management Policy & Procedure
    • Approval of Changes
    • Input Range Validation
    • Vulnerability Remediation Process

  • 8.29 Security testing before release

    Cloud applications and infrastructure changes are security tested before release.

    • Approval of Changes
    • Regression Testing
    • Penetration Testing

  • 8.30 Supervising outsourced development

    Outsourced development of cloud services or workloads is supervised and held to the organization's security requirements.

    • Vendor Management Policy & Procedure
    • Third-Party Criticality Assessments
    • Change Management Policy & Procedure
    • Approval of Changes

  • 8.31 Separate development, test and production

    Development, test and production environments in the cloud are kept apart, for example in separate accounts or projects.

    • Test Data Protection
    • Secure System Modification

  • 8.32 Change control

    Changes to cloud services and configurations follow change control, and customers are told about changes that affect them.

    • Change Management Policy & Procedure
    • Secure System Modification
    • Approval of Changes
    • Deployment Notifications

  • 8.33 Test data

    Test data used in cloud environments is chosen and protected so that production personal data is not exposed.

    • Test Data Protection

  • 8.34 Protecting systems during audits

    Audit and testing work in cloud environments is planned so it does not disrupt services or expose other tenants.

    • Internal Audit
    • Penetration Testing

  • 8.35 Isolation in virtualized environments

    Each tenant's virtual resources, data and workloads are isolated from other tenants and from the provider's internal systems.

    • Tenant Isolation
    • Limit Network Connections
    • External System Connections

  • 8.36 Detecting unauthorized cloud use

    Use of cloud services is monitored to detect and stop unauthorized use, such as unapproved services, leaked credentials or abuse of accounts.

    • Anomalous Behavior Detection
    • Centralized Security Logging
    • Third-Party Criticality Assessments
    • Unauthorized Activity Monitoring