What is ISO 27017?

ISO 27017 is an international standard that provides guidelines for information security controls applicable to the provision and use of cloud services. It is based on ISO/IEC 27002 and specifies additional implementation guidance for cloud-specific controls, supplementing existing information security management systems (ISMS) to reduce cloud-specific risks. It helps cloud service providers and cloud service customers understand their respective roles and responsibilities in maintaining a secure cloud environment. Organizations use ISO 27017 to demonstrate they have the necessary controls in place to protect sensitive data stored in the cloud, address cloud-specific security threats, and meet regulatory requirements.