--- title: "ISO/IEC 27017 Cloud Security FAQ" canonical_url: "https://www.sorena.io/artifacts/global/iso-27017/faq" source_url: "https://www.sorena.io/artifacts/global/iso-27017/faq/items/page/3" author: "Sorena AI" description: "Answers to ISO/IEC 27017:2015 cloud-security questions on shared roles, agreements, administration, logging, assurance, virtualization, and customer controls." published_at: "2026-05-09" updated_at: "2026-07-24" keywords: - "ISO/IEC 27017 FAQ" - "ISO/IEC 27017" - "ISO/IEC 27017 Cloud Security Controls" - "ISO/IEC 27017 FAQ checklist" - "ISO/IEC 27017 FAQ evidence" - "ISO/IEC 27017 FAQ implementation" - "FAQ" - "global compliance" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # ISO/IEC 27017 Cloud Security FAQ Answers to ISO/IEC 27017:2015 cloud-security questions on shared roles, agreements, administration, logging, assurance, virtualization, and customer controls. *FAQ* *Global* *ISO/IEC 27017* ## ISO/IEC 27017 FAQ Use these answers to allocate cloud-security duties, set agreement terms, and test the evidence for each service. This page explains ISO/IEC 27017:2015. ISO lists that edition as published but due for revision, while ITU has superseded the identical 2015 recommendation; confirm the edition required by your contract or certification program. ISO/IEC 27017:2015 answers recurring cloud-security decisions about provider/customer responsibility, service agreements, privileged administration, virtualization, logging and monitoring, provider evidence, customer controls, audit access, and certification claims. ## Definitions ### ISO/IEC 27017:2015 cloud security control guidance **Term:** ISO/IEC 27017:2015 ISO/IEC 27017:2015 is the first edition of the international code of practice that adds cloud-specific implementation guidance to ISO/IEC 27002:2013 and seven additional controls for cloud service customers and cloud service providers. **Why it matters here:** Each answer on this page applies the 2015 guidance to a named service; applicable law, contracts, risk, and the chosen ISMS scope remain separate decision inputs. Sources: - [ISO/IEC 27017:2015 standard page](https://www.iso.org/standard/43757.html?ref=sorena.io) ### Cloud service customer A cloud service customer is the party in the acquirer role that uses a cloud service. Under ISO/IEC 27017:2015, the customer remains accountable for deciding to use the service, should confirm it can perform its allocated security roles, and may need additional controls when preset provider capabilities leave risk gaps. **Why it matters here:** Identify the customer for each named service before applying an answer. One organization can be a customer to an upstream provider and a provider to downstream customers, with different duties in each relationship. Sources: - [ITU-T X.1631 (07/2015), clauses 4.2, 4.3, and 6.1.1](https://www.itu.int/rec/T-REC-X.1631-201507-I/en?ref=sorena.io) ## Browse sub-FAQ modules ### [ISO/IEC 27017 Audit Rights FAQ](/artifacts/global/iso-27017/faq/audit-rights.md) ISO/IEC 27017 does not grant unrestricted cloud-provider audits. Define the contract route for independent assurance, supporting access, exceptions, and escalation. - 4 items ### [ISO/IEC 27017 Cloud Admin Access FAQ](/artifacts/global/iso-27017/faq/cloud-admin-access.md) Apply ISO/IEC 27017 to customer and provider cloud administrators: strong authentication, limited privileges, logged operations, supervised critical work, and review evidence. - 4 items ### [ISO/IEC 27017 Cloud Service Agreements FAQ](/artifacts/global/iso-27017/faq/cloud-service-agreements.md) Use ISO/IEC 27017 to define cloud security roles, provider measures, evidence, incident handling, supplier dependencies, and exit terms in the service agreement. - 4 items ### [ISO/IEC 27017 Customer Controls FAQ](/artifacts/global/iso-27017/faq/customer-controls.md) Identify the cloud controls the customer should assess, configure, operate, monitor, evidence, and review when provider controls do not meet every security requirement. - 4 items ### [ISO/IEC 27017 Logging FAQ](/artifacts/global/iso-27017/faq/logging.md) Allocate cloud event logging and monitoring between provider and customer, verify accessible events, privileged operations, timestamps, retention, alerts, and evidence. - 4 items ### [ISO/IEC 27017 Provider Evidence FAQ](/artifacts/global/iso-27017/faq/provider-evidence.md) Check whether a cloud provider's certificate, audit report, or self-assessment supports its claims for the entity, service, location, controls, and period in scope. - 4 items ### [ISO/IEC 27017 Shared Responsibility FAQ](/artifacts/global/iso-27017/faq/shared-responsibility.md) Allocate ISO/IEC 27017 cloud-security roles to named provider, customer, and upstream parties for one service, then document, communicate, implement, and review the split. - 4 items ### [ISO/IEC 27017 Virtualization Responsibilities FAQ](/artifacts/global/iso-27017/faq/virtualization-responsibilities.md) Allocate tenant isolation, virtual-machine hardening, administrative operations, images, snapshots, and virtual-network policy under ISO/IEC 27017. - 4 items Browse all indexed questions: [/artifacts/global/iso-27017/faq/items](/artifacts/global/iso-27017/faq/items.md) ## All FAQ items *Page 3 of 3. Showing 2 of 32 items.* ### [Who should approve Virtualization Responsibilities decisions under ISO/IEC 27017?](/artifacts/global/iso-27017/faq/virtualization-responsibilities.md#who-should-approve-virtualization-responsibilities-decisions-under-isoiec-27017) *Module: [ISO/IEC 27017 Virtualization Responsibilities](/artifacts/global/iso-27017/faq/virtualization-responsibilities.md)* ISO/IEC 27017 allocates customer and provider duties but does not prescribe internal approval titles. As a practical model, the cloud service owner can approve the layer allocation; platform, network, image, backup, and security owners can accept customer activities; and supplier management can maintain provider commitments and assurance. - Use a named owner, named backup, and named escalation forum. - Separate preparation work from risk acceptance and final approval. - Keep approval records with the evidence rather than in disconnected email threads. Sources for this answer: - [ISO/IEC 27017:2015 standard page](https://www.iso.org/standard/43757.html?ref=sorena.io) - Primary ISO listing for cloud-service security control guidance, including the cloud-specific control context used for virtualization responsibility splits. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - Primary ISO listing for the current ISO/IEC 27002 information-security control guidance. ### [When should Virtualization Responsibilities be reviewed under ISO/IEC 27017?](/artifacts/global/iso-27017/faq/virtualization-responsibilities.md#when-should-virtualization-responsibilities-be-reviewed-under-isoiec-27017) *Module: [ISO/IEC 27017 Virtualization Responsibilities](/artifacts/global/iso-27017/faq/virtualization-responsibilities.md)* ISO/IEC 27017:2015 sets no universal virtualization-review interval. Review when the tenancy or service model, hypervisor or orchestration platform, image pipeline, network architecture, provider feature, agreement, or responsibility boundary changes. - Set a planned review date and a change-trigger rule. - Use findings to update controls, procedures, contracts, risk registers, or training. - Carry unresolved items into management review or risk acceptance. Sources for this answer: - [ISO/IEC 27017:2015 standard page](https://www.iso.org/standard/43757.html?ref=sorena.io) - Primary ISO listing for cloud-service security control guidance, including the cloud-specific control context used for virtualization responsibility splits. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - Primary ISO listing for the current ISO/IEC 27002 information-security control guidance. ## FAQ Pagination - Canonical index (page 1): [/artifacts/global/iso-27017/faq/items](/artifacts/global/iso-27017/faq/items.md) - Page 1 rule: `/page/1` is intentionally not generated; use the canonical index markdown URL. - Current page: 3 of 3 Pages: [1](/artifacts/global/iso-27017/faq/items.md) | [2](/artifacts/global/iso-27017/faq/items/page/2.md) | [3](/artifacts/global/iso-27017/faq/items/page/3.md) [Previous page](/artifacts/global/iso-27017/faq/items/page/2.md) *Recommended next step* *Placement: after implementation guidance* ## Manage ISO/IEC 27017 work Assign owners, request evidence, record decisions and exceptions, and set review dates. - [Open Assessment Autopilot for ISO/IEC 27017](/solutions/assessment.md): Create accountable ISO/IEC 27017 tasks, evidence requests, and review checkpoints. - [Talk through implementation](/contact.md): Review your current scope, evidence gaps, and next implementation steps. --- [Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/global/iso-27017/faq/items/page/3.md