ISO/IEC 27017 FAQ Audit Rights

ISO/IEC 27017:2015 does not create an unrestricted on-site audit right. It says customers should request documented evidence for provider claims. When individual audits are impractical or could increase security risk, the provider should make independent evidence available; a sufficiently transparent independent audit selected by the provider should normally meet the customer's review interest. If independent audit is impractical, the provider should disclose its self-assessment process and results.

Put the enforceable assurance route in the agreement before service approval. Define the report or certification, covered entities and services, locations, period, exclusions, customer controls, access to supporting material, treatment of exceptions, bridge evidence, remediation follow-up, confidentiality limits, cost, notice, and escalation when evidence is insufficient. If binding law, regulation, or an existing customer commitment requires access that the provider will not supply, negotiate a compliant route or do not approve that use; risk acceptance cannot remove the underlying duty.

Keep the signed assurance clause, current report or certificate, scope statement, auditor opinion, exceptions, provider response, bridge evidence, and the customer's assessment together. Record any request for extra material and the provider's response. Here, bridge evidence means information about changes, incidents, and controls after the report period; record who supplied it and which gap it addresses.

A report is usable only for the entities, services, regions, controls, subservice organizations, and period it covers. Check whether the report covers the customer's configuration and retained responsibilities; do not infer coverage from the provider's certification or audit opinion alone.

Supplier management and the cloud service owner should agree the assurance route with security input. Legal counsel should approve negotiated access, confidentiality, liability, cost, and notice terms when those terms are material.

The risk owner decides whether restricted or missing assurance is acceptable. A provider-selected auditor's opinion informs that decision but does not replace the customer's approval.

Review the assurance route before renewal and when the provider entity, service, region, subservice organization, report scope, legal requirement, or material exception changes.

Reassess after a relevant incident, when a certificate expires, or when the report and any bridge evidence no longer cover the period needed for the decision. Document interim evidence and the risk decision if the next independent report is delayed.