Applicability
- ISO/IEC 27017 applies to cloud service customers and cloud service providers across public, private, hybrid, multi-cloud, and other cloud deployment models.
- Firms that traditionally consider themselves only cloud service customers may also act as cloud service providers where they offer hosted applications, client portals, managed solutions, or other cloud-based services to clients or other third parties.
What Are the Most Significant Changes?
The 2026 edition is more than a renumbering exercise. The principal changes include:
- Alignment with ISO/IEC 27002:2022: The standard now follows the organizational, people, physical, and technological control structure used by ISO/IEC 27002:2022. Several controls previously presented as separate cloud controls have been incorporated into broader controls covering areas such as configuration management, information deletion, monitoring, operating procedures, and network security.
- Greater attention to the cloud service chain: : A new control addresses the roles and responsibilities of cloud service partners. This recognizes that cloud services frequently depend on multiple providers, developers, brokers, auditors, and other parties, and that security responsibilities can be lost between them if they are not clearly allocated.
- A new focus on unauthorized cloud use: The revised standard adds a control addressing unauthorized access, data transfer, and other activity involving cloud services. For cloud customers, this brings shadow IT, inappropriate information movement, and anomalous service use more directly into the security program.
- Stronger operational and evidence expectations: The updated guidance more clearly addresses expectations for secure configuration, monitoring, backup and restoration, logging, incident reporting, data location, and the return or deletion of information when a cloud service ends. It also considers cloud service-derived data, not only data originally uploaded by the customer.
What Has Not Changed?
The structure has changed, but the central cloud security principles remain consistent:
- Shared responsibility remains fundamental: Cloud providers are responsible for the controls they operate, but customers remain responsible for defining their requirements, understanding what the provider does and does not control, and addressing any resulting gaps.
- ISO/IEC 27017 remains risk-based and supplemental: The standard complements ISO/IEC 27001 and ISO/IEC 27002 rather than replacing them. Organizations should apply its guidance according to their risks and their legal, regulatory, and contractual requirements.
- Cloud governance remains an ongoing responsibility: Selecting a provider or reviewing its certifications does not complete the process. Organizations must continue to evaluate provider capabilities, monitor material changes, and confirm that the service continues to meet their security requirements.
Looking Ahead
Organizations seeking alignment to the 2026 edition of ISO/IEC 27017 should begin by mapping their current controls to the standard and identifying where policies, responsibility matrices, supplier agreements, and supporting evidence require adjustment.
The larger question is whether cloud governance has kept pace with how cloud services are now being used. Multi-provider dependencies, rapid SaaS adoption, AI-enabled services, and increasing volumes of information created within cloud platforms make responsibility and visibility more challenging to manage. ISO/IEC 27017:2026 provides an updated benchmark for evaluating whether those risks are being addressed clearly and consistently.