What is ISO27017?

ISO/IEC 27017 is an international standard that provides guidelines for information security controls applicable to the provision and use of cloud services. It's essentially an extension of ISO/IEC 27001, tailored specifically for cloud environments. It helps cloud service providers (CSPs) and cloud service customers understand their respective roles and responsibilities in maintaining a secure cloud environment. It provides additional implementation guidance for relevant ISO/IEC 27001 controls, and supplements these with cloud-specific controls, addressing aspects like data location, virtual machine hardening, and access management in the cloud.