Use this ISO/IEC 27017 checklist to decide whether a specific cloud service can meet the customer's security requirements and what each party should operate.
The checklist follows guidance. It is not an official form, a universal control set, or proof of certification. Adapt it to the service risk, agreement, architecture, jurisdiction, and the edition used.
Use this checklist to evaluate a cloud provider and the customer's ability to use the service securely. It is not a universal pass/fail certification checklist: select depth and evidence from the service risk, contract, architecture, and applicable legal or regulatory requirements.
Start with the legal provider entity, named service, deployment and service models, regions, data and workloads, administrators, interfaces, upstream providers, business dependency, and exit constraints. Evidence for another service, entity, region, or period does not answer the assessment.
Compare the customer's requirements with the provider's fixed and configurable capabilities before contracting. For every gap, choose another service, add an enforceable commitment, implement a customer control, or obtain authorized risk acceptance.
Confirm that the agreement allocates provider, customer, and shared responsibilities. ISO/IEC 27017 specifically addresses access, backup, cryptography, vulnerability management, incidents, testing, audit evidence, logging, continuity, and protection of information when the agreement ends.
Test relevant operations, including tenant isolation, virtual-machine and network configuration, privileged access, monitoring, logs, backup and recovery, incident notification, and supervised critical operations. The exact split changes with the service model and provider design.
Sources (2)
Confirms that ISO/IEC 27017:2015 supplies cloud-specific guidance and controls for both providers and customers.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
Official ITU publication of the identical 2015 text supporting the responsibility, agreement, isolation, hardening, operations, monitoring, and termination checks.
Completion requires evidence for both sides of the responsibility boundary. A provider report can support controls operated by the provider, but it does not show that the customer enabled logging, restricted administrators, hardened workloads, or tested recovery.
Record the evidence's service scope, provider entity, locations, period, exceptions, and method. Where individual customer audits are impractical or add security risk, ISO/IEC 27017 allows for independent evidence, with sufficient transparency, or a disclosed provider self-assessment when an independent audit is impractical.
Sources (3)
Supports the underlying information-security control catalogue used when mapping cloud-provider checklist evidence to controls.
Information security controls
Supports keeping cloud-provider checklist decisions inside the ISMS evidence, ownership, and review process.
Information security, cybersecurity and privacy protection — Information security management systems — Requirements
Supports the provider and customer evidence split, including independent evidence, monitoring, logging, responsibility records, and termination arrangements.
The customer service owner coordinates the assessment with security, architecture, legal or procurement, privacy where applicable, operations, and the provider. Control owners supply evidence for their allocated duties; only an authorized risk owner accepts unresolved residual risk.
Run the checklist before selection or renewal, then repeat it after material changes to the service, region, provider chain, architecture, , contract, or applicable requirements. Incidents, failed tests, and expiring assurance are additional triggers.
Sources (2)
Supports keeping cloud-provider checklist decisions inside the ISMS evidence, ownership, and review process.
Information security, cybersecurity and privacy protection — Information security management systems — Requirements
Confirms ISO/IEC 27017 is the cloud-services control guidance this checklist maps into provider and customer responsibilities.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
A yes/no answer without scope, owner, evidence, exception, and review trigger is not enough to support a service decision. Reject marketing claims and certificates that do not cover the named provider entity and service.
Do not assume that the provider performs a control because it operates the infrastructure. ISO/IEC 27017 notes, for example, that infrastructure as a service (IaaS) customers may be responsible for backing up data produced in their environment and for logging events in their own virtual machines and applications.
Sources (2)
Confirms ISO/IEC 27017 is the cloud-services control guidance this checklist maps into provider and customer responsibilities.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
Supports the underlying information-security control catalogue used when mapping cloud-provider checklist evidence to controls.
Information security controls
Keep the checklist with the risk decision and evidence index. When a trigger occurs, reopen the affected checks and update the , control evidence, agreement record, and downstream operating procedures together.
ISO now lists the 2015 edition as withdrawn and ISO/IEC 27017:2026 as its replacement. This page retains the 2015 guidance; confirm the edition required by the agreement or assessment before reusing its control references. Review the replacement text before changing control identifiers or evidence mappings.
Sources (2)
Supports the underlying information-security control catalogue used when mapping cloud-provider checklist evidence to controls.
Information security controls
Supports keeping cloud-provider checklist decisions inside the ISMS evidence, ownership, and review process.
Information security, cybersecurity and privacy protection — Information security management systems — Requirements
Assign each check, attach service-specific evidence, record exceptions and approvals, and reopen the assessment when the service or provider boundary changes.
Convert ISO/IEC 27017 Cloud Provider Checklist into accountable tasks, evidence requests, and review checkpoints.
Review your current scope, evidence gaps, and next implementation steps.
"Information security, cybersecurity and privacy protection — Information security management systems — Requirements"
"Code of practice for information security controls based on ISO/IEC 27002 for cloud services"
"Information security controls"
ISO/IEC 27017 is cloud control guidance, not a standalone management-system certification standard. Learn how to check the actual ISO/IEC 27001 claim and scope.
Answers to ISO/IEC 27017:2015 cloud-security questions on shared roles, agreements, administration, logging, assurance, virtualization, and customer controls.
How cloud providers and customers apply ISO/IEC 27017:2015 through scoped risks, allocated responsibilities, agreements, controls, evidence, and review.
Map ISO/IEC 27017:2015 cloud guidance and CLD controls into an ISO/IEC 27001:2022 ISMS with edition-aware rationale, owners, evidence, and SoA treatment.
Compare ISO/IEC 27017 responsibilities for cloud service providers and customers, with service-model examples, evidence, and review triggers.
What an ISO/IEC 27017:2015 hyperscaler evidence pack should contain, how to test coverage, and where provider assurance must be joined to customer evidence.
A service-specific workflow for testing hyperscaler claims, collecting provider and customer evidence, resolving gaps, and approving cloud risk under ISO/IEC 27017:2015.
How to allocate provider, customer, and shared cloud security activities under ISO/IEC 27017:2015, document hand-offs, and test the allocation against evidence.
Compare ISO/IEC 27017:2015 with CSA CCM v4.1 by scope, control structure, responsibility mapping, assurance use, and evidence.
Compare ISO/IEC 27017:2015 cloud security guidance with ISO/IEC 27018:2025 public-cloud PII processor guidance by scope, role, controls, and evidence.
Compare ISO/IEC 27017 cloud control guidance with SOC 2 attestation reports by purpose, scope, criteria, period, evidence, and customer responsibilities.
ISO/IEC 27017 does not grant unrestricted cloud-provider audits. Define the contract route for independent assurance, supporting access, exceptions, and escalation.
Apply ISO/IEC 27017 to customer and provider cloud administrators: strong authentication, limited privileges, logged operations, supervised critical work, and review evidence.
Use ISO/IEC 27017 to define cloud security roles, provider measures, evidence, incident handling, supplier dependencies, and exit terms in the service agreement.
Identify the cloud controls the customer should assess, configure, operate, monitor, evidence, and review when provider controls do not meet every security requirement.
Allocate cloud event logging and monitoring between provider and customer, verify accessible events, privileged operations, timestamps, retention, alerts, and evidence.
Check whether a cloud provider's certificate, audit report, or self-assessment supports its claims for the entity, service, location, controls, and period in scope.
Allocate ISO/IEC 27017 cloud-security roles to named provider, customer, and upstream parties for one service, then document, communicate, implement, and review the split.
Allocate tenant isolation, virtual-machine hardening, administrative operations, images, snapshots, and virtual-network policy under ISO/IEC 27017.