Internationally recognized certification body ensuring compliance, quality, and global market access for your business.
Contact For Services
Join thousands of professionals who have upgraded their skills through our certified training programs globally.
Explore Training Calendar
For cloud service providers, SaaS companies, managed service providers, and organizations using cloud platforms, this revision is an important opportunity to review existing security practices. Understanding the updated edition can help organizations identify relevant changes, clarify cloud security responsibilities, and strengthen the way cloud risks are managed. This article explores what is officially known about ISO/IEC 27017:2026, the practical areas organizations should review, and how to prepare for the updated guidance.
ISO/IEC 27017 is an international standard providing information security control guidance for cloud services. It builds on ISO/IEC 27002 and addresses the security considerations that arise when cloud services are provided and used. The guidance is intended for both cloud service providers (CSPs) and cloud service customers (CSCs), helping them understand and implement appropriate safeguards across their respective environments.
Unlike a general information security approach that may not fully address cloud-specific relationships, ISO/IEC 27017 considers the shared nature of cloud computing. A provider may operate the underlying infrastructure, while a customer manages identities, application configurations, data classification, or user permissions. Security responsibilities therefore need to be understood in the context of each service and contractual arrangement.
The standard can be relevant to public, private, and hybrid cloud environments. Its guidance should be applied according to an organization’s risk assessment and the legal, regulatory, contractual, and operational requirements that affect its cloud services.
The first edition, ISO/IEC 27017:2015, was developed to provide cloud-specific security guidance based on ISO/IEC 27002. The second edition, ISO/IEC 27017:2026, replaces the previous edition following a technical revision. ISO identifies three main categories of change in the new edition: an updated title and scope, a revised document structure using a simpler taxonomy and associated attributes for security controls, and changes to the controls themselves, including merged, removed, and newly added controls.
These changes mean organizations should not assume that their previous implementation documents can simply be carried forward without review. The appropriate approach is to compare the existing control framework and supporting evidence with the published 2026 edition, then determine what needs to be updated for the organization’s specific cloud services.
The publicly available ISO overview confirms these broad changes, but it does not provide a complete clause-by-clause comparison of the two editions. Organizations should consult the official 2026 publication before describing a specific control as new, removed, or materially changed.
Although a detailed comparison requires access to the complete standard, organizations can begin reviewing the cloud security practices that support an effective implementation. The following areas are practical priorities for assessing existing arrangements against the updated edition. They should be treated as review areas rather than a claim that every item represents a newly introduced 2026 requirement.
Cloud security depends on cooperation between service providers and customers. A cloud provider may secure physical facilities, underlying infrastructure, or certain platform components, while the customer remains responsible for account permissions, application settings, data handling, and user activities. The precise division of responsibility varies by service model and contract.
Organizations should review whether responsibilities are documented, understood, and supported by operational evidence. Cloud service agreements, responsibility matrices, internal policies, and escalation procedures should be consistent with the actual service configuration.
Access management remains a fundamental cloud security concern. Excessive privileges, inactive accounts, weak authentication, and poorly managed administrative access can expose sensitive information or critical systems. Organizations should assess how identities are created, approved, reviewed, modified, and removed across cloud platforms.
Practical review activities include checking privileged accounts, applying least-privilege access, using multi-factor authentication where appropriate, and maintaining evidence of periodic access reviews. Automated provisioning and deprovisioning can also reduce the risk of access remaining active after an employee or contractor changes roles or leaves the organization.
Organizations need to understand what information they store in cloud environments, where it is processed, who can access it, and how it is protected throughout its lifecycle. Sensitive information may be distributed across storage services, databases, backups, collaboration platforms, and third-party applications.
A cloud data protection review should consider information classification, encryption, key management, data transfer, retention, backup protection, and secure deletion. Data residency and cross-border transfer obligations may also affect how services can be configured and used.
Organizations should align their controls with business risk, contractual commitments, applicable privacy requirements, and the capabilities of the cloud service. Where a provider manages certain technical safeguards, customers should establish how those safeguards are verified and how evidence is retained.
Misconfigured cloud resources can create unnecessary exposure. Publicly accessible storage, open management interfaces, overly permissive network rules, insecure APIs, and inconsistent logging settings may introduce vulnerabilities even when the underlying platform is operated by a reputable provider.
Organizations should review how cloud resources are configured, approved, monitored, and changed. Security baselines, configuration scanning, change approval processes, and periodic technical reviews can help identify deviations from approved settings. Where infrastructure is deployed through code, organizations can consider integrating security checks into development and deployment workflows.
Cloud incidents can involve compromised accounts, exposed data, service outages, malicious changes, or disruptions affecting a provider or an interconnected service. Effective response depends on understanding how the organization will detect an incident, obtain relevant information, coordinate with the provider, and communicate with affected stakeholders.
Review incident response procedures to ensure that responsibilities, reporting channels, evidence preservation, recovery steps, and escalation timelines are clear. Business continuity and disaster recovery arrangements should also reflect the actual architecture, service dependencies, backup design, and recovery objectives.
Testing these arrangements is important. Tabletop exercises, recovery tests, and scenario-based reviews can reveal gaps that policy documents alone may not identify.
Organizations increasingly rely on multiple cloud vendors, subcontractors, and specialist service providers. A security weakness or service disruption at one supplier can affect the wider organization, particularly where services exchange sensitive data or support critical business processes.
Cloud supplier reviews should consider security responsibilities, incident notification, service availability, access to assurance evidence, subcontracting arrangements, data return, secure deletion, and termination procedures. Organizations should also assess whether supplier commitments are sufficient for their risk profile and regulatory obligations.
Cloud environments can generate substantial volumes of activity and security logs. Without appropriate monitoring, organizations may struggle to detect suspicious behavior, investigate incidents, or demonstrate that controls operate as intended.
Review which events are logged, how long logs are retained, who can access them, and how alerts are investigated. Evidence should be proportionate to risk and should help demonstrate the operation of relevant controls without unnecessarily exposing confidential information.
ISO/IEC 27017 should be considered alongside the broader information security framework used by an organization. ISO/IEC 27002 provides information security control guidance, while ISO/IEC 27017 adds cloud-specific guidance and controls for the provision and use of cloud services. ISO/IEC 27001 specifies requirements for an information security management system (ISMS).
Organizations with an established ISO/IEC 27001-based ISMS can use their existing risk assessment, asset inventory, supplier management, incident response, and internal audit processes to support their cloud security review. They should still assess whether cloud-specific risks and responsibilities are adequately addressed and whether the 2026 revision affects their control documentation or implementation.
ISO/IEC 27017 does not automatically replace ISO/IEC 27001, nor should organizations assume that implementing its guidance by itself establishes ISO/IEC 27001 conformity. The standards serve related but distinct purposes and should be used according to the organization's objectives and applicable requirements.
The updated edition is relevant to organizations that provide cloud services or depend on cloud platforms to deliver products, manage information, and support business operations. The depth of review should reflect the organization's cloud architecture, risk exposure, service model, and contractual obligations.
A structured review can help organizations understand the impact of the revised edition without making unsupported assumptions about individual control changes. The following steps provide a practical starting point.
Use the official ISO publication to confirm the scope, structure, control guidance, and applicable terminology. Review the full text rather than relying solely on summaries or informal comparison articles. Record the edition used as the basis for the organization's review.
Create or update an inventory of cloud services, providers, data types, integrations, and business processes. Identify the parties responsible for relevant security activities, including activities handled jointly by the provider and customer.
Compare existing policies, procedures, technical configurations, contracts, and control evidence with the applicable guidance in ISO/IEC 27017:2026. Record gaps, affected services, risk levels, existing safeguards, and recommended actions. A formal comparison should distinguish controls that have changed in the new edition from existing practices that need improvement for other reasons.
Prioritize findings according to business impact, likelihood, legal or contractual significance, and exposure of sensitive information. Assign action owners and target dates, and identify whether remediation requires technical changes, revised agreements, staff training, or stronger oversight of cloud suppliers.
Update relevant risk records, policies, responsibility matrices, procedures, and control evidence where needed. Validate that implemented safeguards operate effectively and that staff understand their responsibilities. Where appropriate, use internal audits, technical testing, management reviews, and incident exercises to evaluate the effectiveness of the updated arrangements.
An edition update can be an opportunity to improve cloud security, but organizations may lose that opportunity if they treat the revision as a simple documentation exercise. Common mistakes include:
Organizations reviewing their cloud security arrangements may benefit from structured gap assessment, risk review, documentation improvement, and implementation support. B-ADVANCY provides IT process compliance and information security-related services intended to help organizations strengthen their controls, assess gaps, and improve alignment with relevant frameworks and business requirements.
Depending on an organization's needs and agreed scope, support may include reviewing existing security documentation, identifying improvement opportunities, clarifying control responsibilities, preparing remediation plans, and strengthening evidence of control implementation. Organizations should confirm the specific scope and deliverables before engaging a service provider.
Learn more about B-ADVANCY IT Process Compliance services and discuss the cloud security and compliance support appropriate to your organization.
The latest edition is ISO/IEC 27017:2026, the second edition, published in July 2026. It replaces ISO/IEC 27017:2015.
ISO confirms changes to the title and scope, a revised structure using a simpler taxonomy and associated attributes for security controls, and control changes that include merged, removed, and newly added controls. A detailed clause-by-clause comparison should be based on the full published standard.
Yes. ISO/IEC 27017 applies to public, private, and hybrid cloud deployment models. The way guidance is implemented should reflect the service architecture, internal relationships, and allocation of responsibilities.
No. ISO/IEC 27001 specifies requirements for an information security management system, while ISO/IEC 27017 provides cloud-specific security control guidance based on ISO/IEC 27002. The standards can complement one another but serve different purposes.
Organizations should review the official publication, identify relevant cloud services and responsibilities, assess existing controls against the revised guidance, prioritize gaps, update documentation where necessary, and validate implementation through appropriate testing and review.
ISO/IEC 27017:2026 is the revised second edition of the cloud security guidance standard, published in July 2026 to replace the 2015 edition. ISO confirms that the revision changes the title and scope, reorganizes the presentation of controls, and includes controls that have been merged, removed, or newly added. These changes make it important for cloud service providers and customers to review the published edition rather than assume their previous implementation remains fully aligned.
Organizations can begin by reviewing their cloud services, shared responsibilities, data protection practices, access management, supplier arrangements, incident response, and control evidence. A risk-based gap assessment can then help determine the specific actions needed. By approaching the revision carefully and validating changes against the official standard, organizations can strengthen cloud security governance and maintain a clearer understanding of their responsibilities.
📞 WhatsApp:Chat on WhatsApp📧 Email:info@b-advancy.com
