ISO 27017 Implementation and Audit Preparation
Demonstrating Best Practices in the Use and Provision of Cloud Services
As the use of cloud-based services continues to expand, it is becoming increasingly important to be able to demonstrate that they are being used and provided in a secure manner. ISO/IEC 27017:2026 is the leading international standard for cloud security, offering information security controls and guidance for both cloud service customers and cloud service providers.
Built on ISO 27002, ISO 27017 extends familiar security controls to address risks specific to cloud environments. Implementing it allows organizations to demonstrate best practices to clients and stakeholders through third-party validation and attestation, while strengthening the governance and risk mitigation activities that support them.
Who This Page Is For
This page is relevant for organizations implementing ISO 27017 for the first time, either as an extension to an established ISO 27001 program or in conjunction with standing up an Information Security Management System from scratch, as well as those looking to upgrade their existing ISO 27017 to the latest version of the standard. It is relevant for both cloud service customers and cloud service providers across public, private, hybrid, or multi-cloud environments.
Resiliam works with organizations at any stage of the process, from initial scoping through attestation and ongoing program maintenance.
What Does The Process Involve?
ISO 27017 implementation entails assessing the organization’s current conformance to the standard’s controls and guidance, producing a formal Gap Analysis Report and Remediation Plan, implementing the remediation work needed to close identified gaps, and preparing the organization for an attestation audit.
The value of the engagement extends beyond the audit itself. It gives an organization a clearer picture of where its cloud security controls actually stand. Cloud service risks become easier to identify and address, and shared responsibilities between the cloud service customers and providers become more manageable. The result is a materially stronger cloud security program that an organization can confidently defend to clients and auditors, not only point to on paper.
Organizations choosing to implement ISO 27017 will be able to clearly demonstrate:
- Enhanced scrutiny over the organization’s information security supply chain;
- A thorough examination of the organization’s security controls in cloud environments, and where necessary, consideration of any mitigating controls;
- A third-party risk management process that ensures clearly defined security responsibilities within agreements between cloud service providers and customers; and
- Best practices in the implementation of technical security controls for the use and provisioning of cloud services, supported by a robust cloud information security policy.
Resiliam’s approach is built around a program the client’s team can understand and own, rather than documentation only Resiliam can explain. Organizations that go through this process go into their audits with confidence knowing they have a program built to stand up to scrutiny.
What Resiliam Delivers
- Assessment of your current state of conformance to ISO 27017 controls and guidance, with a formal Gap Analysis Report and Remediation Plan identifying areas of nonconformance and prioritized recommendations
- Remediation support, including addressing cloud service risks in information security risk assessments, incorporating cloud-specific elements into ISMS documentation, advising on cloud service provider contract reviews and diligence processes, and developing an information security policy for cloud computing
- Control gap remediation and evidence review across all applicable ISO 27017 controls and guidance
- Attestation audit preparation, including training, preparation of audit guides, support and audit attendance.
