Key Facts
- Regulator
- ISO/IEC JTC 1/SC 27 (published by ISO and IEC)
- Latest version
- ISO/IEC 27017:2026, Edition 2 (Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for cloud services). It replaces ISO/IEC 27017:2015, which ISO lists as withdrawn.
- Effective
- 27 July 2026
- Official text
- www.iso.org ↗
What is ISO/IEC 27017?
ISO 27017, formally ISO/IEC 27017, is the international standard giving guidance on information security controls for cloud services. ISO and IEC publish it through committee JTC 1/SC 27. It builds on ISO/IEC 27002 and applies to both cloud service customers and cloud service providers, across public, private and hybrid cloud.
The current version is ISO/IEC 27017:2026, Edition 2, published on 27 July 2026. Its full title is Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for cloud services. It is written against the 2022 edition of ISO/IEC 27002, and it replaces ISO/IEC 27017:2015, which ISO withdrew the same day.
That matters for anyone reading older material. A checklist or guide written against the 2015 edition is out of date.
The standard is guidance on controls. It is not a management system standard, and it does not tell you how to run an ISMS.
Why it matters
The customer's security questionnaire asks whether your cloud service follows ISO 27017. Your team half-knows the answer, because nobody has written down which controls you run and which the customer runs.
That gap is what the standard addresses. ISO/IEC 27017 sets out how controls apply across customer and provider environments, so shared responsibility is stated rather than assumed.
A shared responsibility model nobody has written down belongs to nobody.
The pressure comes from buyers. In the UK, the NCSC tells cloud customers to consider what evidence a provider has given them to be confident in the statements it makes. A provider's ISO/IEC 27017-aligned controls are the kind of evidence that gets weighed in that conversation.
On ISO 27017 certification, be careful what you promise. ISO publishes the standard but does not certify anyone against it, and the routes certification bodies offer vary. Confirm the scope with an accredited certification body before telling a customer which route applies.
Who it applies to
ISO/IEC 27017 applies to two groups. Cloud service providers use it to decide what to build in and what to tell customers. Cloud service customers use it to decide what they must still do themselves.
A firm that never buys or sells cloud services has little reason to read it. Most technology firms do one or both.
Obligation. ISO/IEC 27017 is voluntary guidance. It becomes binding for a firm only where a customer contract, tender or supplier requirement names it.
The relationship to ISO 27001 is one of layers. ISO 27001 is the management system you may already hold, and its nearest Annex A control is A.5.23 Information security for use of cloud services. ISO/IEC 27017 sits a layer down: it is built on ISO/IEC 27002, the controls guidance, and adds cloud-specific guidance and controls on top.
ISO/IEC 27018 sits alongside it as the companion standard for personal data in public clouds.
The UK position
No UK statute or regulator we found names ISO/IEC 27017 or requires it. A UK firm meets it commercially: in supplier assurance, procurement and customer due diligence.
The nearest UK reference point is the NCSC Cloud Security Principles (version 2.1), the UK government's own guidance for choosing a cloud provider. It covers similar ground, including supply chain, governance and operational security. It is separate guidance and does not cite ISO/IEC 27017.
A UK SaaS or hosting firm usually meets ISO 27017 when a larger customer asks about it, not when a regulator does.
Key requirements
ISO 27017 is organised around the controls in ISO/IEC 27002, with cloud-specific material added. The 2026 edition's published scope describes the same two layers of content as the 2015 edition:
- Implementation guidance for existing controls. Extra guidance on the relevant ISO/IEC 27002:2022 controls where cloud changes how they work.
- Additional cloud-specific controls. Further controls, with guidance, that relate only to cloud services.
- Shared responsibility. The standard clarifies how each control applies in the customer's environment and in the provider's, and who answers for which. Customer guidance and provider guidance are meant to be read together.
- Risk-based selection. Controls are chosen according to risk assessment and legal, regulatory and contractual requirements, not applied wholesale.
The standard does not hand you a fixed checklist to tick. It expects you to decide which controls apply, and to be able to say why.
What the 2026 edition changes
ISO/IEC 27017:2026 moves the guidance onto ISO/IEC 27002:2022, so control references copied from the 2015 edition may no longer line up. The public scope does not state the new edition's control count, and this entry does not guess at it. Any "ISO 27017 controls list" built on the 2015 edition's cloud controls should be checked against the published 2026 text.
Frequently asked questions
ISO 27001 is the certifiable management system standard. ISO/IEC 27017 is guidance with no management system requirements of its own, so a firm usually applies it inside an ISO 27001 ISMS and records the cloud controls it adopts in its Statement of Applicability. ISO 27001 asks how you run information security overall; ISO/IEC 27017 asks how controls work in cloud services.
ISO/IEC 27017:2026, Edition 2, is the current version. It was published on 27 July 2026, and ISO withdrew ISO/IEC 27017:2015 the same day. A customer questionnaire, certificate scope or gap assessment that still cites the 2015 edition refers to withdrawn text, so check which edition is meant before you answer.
Yes. ISO/IEC 27017 applies to all cloud deployment models, including private cloud. In a private cloud the provider is often an internal IT team, and the 2026 edition notes that its controls still apply, though adjustments can be needed to fit the relationships and abilities of internal departments. Who runs which control still needs a written answer.
Certification bodies offer ISO 27017 certification, usually as an extension to an ISO 27001 certificate rather than on its own. If a supplier claims it, ask for the certificate and its scope statement: both ISO/IEC 27017 and the cloud services you buy should be named. Before promising a customer a certificate yourself, confirm the route with an accredited certification body.
ISO/IEC 27017 covers information security controls for cloud services in general, for customers and providers. ISO/IEC 27018 is narrower: a code of practice for protecting personal data (PII) in public clouds, where the provider processes that data for its customers. Both build on ISO/IEC 27002, and the current ISO/IEC 27018 edition dates from 2025. A provider holding customers' personal data reads both.