ISO/IEC 27017 FAQ Customer Controls

Use a five-step decision. Define the customer's legal, contractual, policy, availability, confidentiality, integrity, and recovery requirements; identify the exact service, tier, region, and provider capabilities; allocate each task between customer and provider; treat every capability gap; then test and approve the resulting control set. ISO/IEC 27017:2015 says customers should consider gaps before selection, manage service use to meet their requirements, and add controls when preset provider controls do not adequately mitigate risk.

Apply the service-model branch to each layer instead of using the service label as the answer. In IaaS, provider event logging can stop at infrastructure components while the customer logs its virtual machines and applications; backup generally resides with the customer unless the provider supplies it. A PaaS customer may also need to back up customer data produced through development capabilities, including executable files. In SaaS, the provider may operate more technical layers, but the customer still controls its service decision, customer identities, available configuration, customer procedures, and assigned handoffs.

When the provider supplies backup, request specifications for scope and schedule, methods and formats, encryption where relevant, retention, integrity verification, restore procedures and timescales, testing, and storage location. Verify those specifications against the customer's requirements. If the provider does not supply the needed backup capability, the standard assigns implementation to the customer; buying the service does not create a backup by itself.

Document each customer control against the named service, risk or requirement, responsible actor, configuration or procedure, provider dependency, evidence source, exception, and review trigger. A provider certificate can support a provider claim within its scope, but it does not show that the customer enabled a setting, reviewed access, collected its application logs, tested restoration, or completed another customer-operated task.

Use the approved requirement and service assessment, responsibility matrix, configuration baseline or export, identity and access review, known-event logging test, backup specification and restore result, incident exercise, vulnerability record, change assessment, and exit test as applicable. Evidence should cover the same service, tier, region, architecture, and period as the decision.

For each sample, identify the account, resource, or handoff; expected setting or procedure; observed result; evidence time; reviewer; exception; follow-up owner; and due date. Provider documentation can describe a capability. Customer evidence should show whether the organization enabled, operated, reviewed, and corrected its side.

ISO/IEC 27017 assigns responsibilities to the customer and provider but does not prescribe the customer's internal job titles. As a practical model, the cloud service owner can own the customer-side control set, while platform, identity, security operations, application, backup, incident, and exit owners approve and operate the controls allocated to them.

Supplier management should maintain provider dependencies. Privacy, legal, resilience, or regulatory owners should review the controls that support their requirements, and the authorized risk owner should decide unresolved gaps.

ISO/IEC 27017:2015 sets no universal control-review interval. Set one from risk and applicable requirements, then review whenever the service model, feature set, service tier, provider chain, architecture, data location, agreement, assurance report, or customer requirement changes.

Also review after a relevant incident, failed restore, access finding, or monitoring gap. Update the responsibility matrix, configuration baseline, risk treatment, and evidence request together.