ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 27017:2026 is the second edition of the international standard that gives information security controls guidance for cloud services. The International Organization for Standardization lists it as published on 27 July 2026, and it supersedes ISO/IEC 27017:2015, which has been withdrawn.
The update matters for any organization that provides or uses cloud services and has told customers it follows ISO 27017. The new edition is reorganized around the same structure as ISO 27002:2022, which most ISO 27001 users already know, and it reduces the stand-alone cloud-specific controls to four.
This guide explains what changed, what has not, and how to update your program. It draws on the ISO catalogue entry and published commentary, so check the standard itself and your certification body for transition rules before you commit to dates.
Free gap assessment
Where do you actually stand against ISO 27001?
Score every management system clause and all 93 Annex A controls, free, and get a prioritised gap list back.
Run the free ISO 27001 gap assessment → or View premium report sample
ISO 27017 is a guidance standard. It builds on ISO 27002 by adding cloud-specific implementation guidance for controls and by adding a few controls for cloud services. It helps cloud service customers and cloud service providers decide what security measures they need and who is responsible for each.
It is not a management system standard, so you do not certify to it in isolation. In practice, an organization that holds an ISO 27001 certificate can ask its certification body to include the cloud controls in the scope, which is how most people talk about being certified to ISO 27017. The ISO catalogue page at ISO/IEC 27017:2026 on the ISO website gives the official details.
Our overview of ISO 27017 explains the background, and the companion standard for personal data, described in ISO 27018, covers protection of personally identifiable information in public clouds.
The biggest change is structural. The 2015 edition followed ISO 27002:2013 and added seven cloud controls. The 2026 edition follows the structure of ISO 27002:2022, with its four themes of organizational, people, physical and technological controls, and folds several old cloud topics into the matching 27002 controls.
Published commentary lists four remaining stand-alone cloud controls: shared roles and responsibilities in a cloud computing environment, agreement on the roles and responsibilities of the cloud service partner, segregation in virtual computing environments, and detection and prevention of unauthorized use of cloud services. Two of these address ground that was not stand-alone before, namely partner agreements and unauthorized cloud use.
Because the wording and numbering are controlled by ISO, read the published text before you rewrite your documents. Commentary is helpful but may not match the standard in every detail.
| Point | ISO/IEC 27017:2015 | ISO/IEC 27017:2026 |
|---|---|---|
| Status | Withdrawn | Current (second edition) |
| Base | ISO 27002:2013 structure | ISO 27002:2022 structure |
| Stand-alone cloud controls | Seven CLD controls | Four CLD controls |
| Role | Guidance for cloud customers and providers | Guidance for cloud customers and providers |
| Certification | Usually an extension of ISO 27001 | Usually an extension of ISO 27001 |
If you followed the 2015 edition, your Statement of Applicability and control mapping probably reference the old CLD numbering. You will need to map each old control to its new home. For example, virtual machine hardening and virtual network alignment now sit with the general technology controls that mirror ISO 27002:2022, instead of standing alone.
Start with a simple crosswalk table: old control, new control, status, owner and evidence. That table becomes your transition plan and your answer when a customer or auditor asks how you moved to the new edition. The hardening guidance in ISO 27017 virtual machine hardening remains useful for the technical content.
Also review your supplier register. The new partner agreement control makes it worth checking that agreements with cloud partners describe who does what.
Most cloud security failures come from assumptions about who looks after what. The shared roles control asks the customer and the provider to agree on responsibilities and to document them. A shared responsibility matrix is the practical tool: a table of controls with a column for provider and a column for customer.
The partner agreement control extends that idea to other parties in the chain, such as resellers and managed service partners. Ask each one to confirm which controls they operate, and keep the confirmation with your contract file. The guide on cloud service agreement lists terms worth checking.
Include exit. If you cannot leave a provider safely, your leverage is limited. A documented cloud exit plan is a good companion to these agreements.
Segregation in virtual computing environments is carried forward. Customers should be able to rely on the provider to keep tenants apart, and providers should be able to show how. Evidence might include architecture descriptions, penetration test summaries and independent audit reports.
Detection of unauthorized use of cloud services is a newer focus. Staff sign up for cloud tools without approval, creating shadow IT and unmanaged data. Controls include a register of approved services, network and identity monitoring to spot unsanctioned ones, and a policy that says what happens next.
Both controls need owners and metrics. For example, count the number of unapproved services found each quarter and the time taken to onboard or block them.
Many organizations ask how the standard compares to other cloud assurance options. The relationship with the Cloud Security Alliance program is explained in ISO 27017 vs CSA STAR, and the difference from the personal data standard is covered in ISO 27017 vs ISO 27018.
If you process personal data for customers, the processor obligations in PII processor still apply. Privacy and security requirements often run side by side in cloud contracts.
Remember that the cloud standard sits on top of ISO 27001. If your ISMS is weak, the cloud controls will not fix it, so check the foundation first.
First, confirm with your certification body how and when the new edition applies to audits. Do not assume dates. Second, obtain the standard and read the changed controls. Third, create the crosswalk and gap list. Fourth, update policies, the Statement of Applicability and supplier documents. Fifth, brief the teams that own cloud operations and procurement.
Sixth, collect evidence for the four cloud controls and the updated mappings. Seventh, run an internal audit on them before the external audit. Timelines depend on your size and cloud footprint, so treat any schedule as illustrative until you have confirmed it with your auditor.
Keep a record of decisions. If you decide a control is not applicable, write the reason in the Statement of Applicability.
Updating policies and records for a new standard edition takes time, and starting from blank documents slows it further. A prepared set of templates helps you map, document and evidence controls in a consistent format.
The ISO 27017 Toolkit and ISO 27018 Cloud Pack provides 67 templates that extend an ISO 27001 ISMS to the cloud, covering shared responsibility, tenant isolation, monitoring and ISO 27018 obligations. Because the toolkit was built around the earlier control set, use your crosswalk to align the templates to the ISO 27017:2026 numbering and wording.
If you are pricing the work, see ISO 27017 certification cost for the main cost drivers.
Give the update to a single owner, usually the ISMS manager or head of cloud security, and support them with named contacts in procurement, engineering and legal. Procurement checks partner agreements, engineering handles segregation and monitoring, and legal reviews contract wording. Hold a short fortnightly check-in until the crosswalk is complete and the Statement of Applicability is updated.
Report progress in simple terms: controls mapped, controls evidenced, gaps open and dates agreed with your auditor. This lets leadership see the status without reading the standard, and it keeps the transition from being forgotten during busy quarters.
Finally, brief your sales and customer success teams. Customers will ask whether you follow the current edition, and a clear, accurate answer backed by your crosswalk builds trust quickly.
The first mistake is relying on outdated documents that cite the 2015 controls and numbering. The second is assuming the provider has covered everything, when the customer keeps responsibility for configuration, access and data. The third is treating cloud controls as a separate project instead of part of the ISMS.
The fourth is ignoring shadow IT. A polished policy means little if teams quietly use unapproved tools. The fifth is skipping the crosswalk, which leaves auditors unable to see how you moved from one edition to the next.
Keep the plan practical: one crosswalk, one evidence index and one owner for each cloud control.
Yes. ISO lists the second edition as published on 27 July 2026. It supersedes the 2015 edition, which has been withdrawn.
The structure now follows ISO 27002:2022, and the stand-alone cloud controls are reduced to four, with other cloud topics folded into the 27002 controls.
No. It is guidance, and certification is normally achieved as an extension of an ISO 27001 certificate.
Yes, if it references the 2015 controls. Build a crosswalk from the old controls to the new ones and confirm transition timing with your certification body.
Both cloud service customers and cloud service providers.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026