ISO/IEC 27017 FAQ Provider Evidence

List the provider claims that affect service approval, such as implementation of named controls, compliance with applicable contractual or legal requirements, data location, isolation, backup, incident handling, or continuity. Request a document that substantiates each claim. Clause 18.1.1 says the provider should identify the jurisdictions governing the service and provide current compliance evidence when requested; the customer should consider both provider and customer jurisdictions.

Apply the clause 18.2.1 evidence sequence. A relevant independent audit selected by the provider is normally acceptable when it gives sufficient transparency and individual customer audits are impractical or could increase security risk. If an independent audit is impractical, the provider should conduct a self-assessment and disclose its process and results. Certification is one possible form of evidence, not the only route and not proof beyond its stated scope.

Check the provider legal entity, named services and tiers, locations, assessment criteria, control period or point-in-time date, exclusions, upstream or subservice organizations, auditor opinion, exceptions, and complementary customer controls. For any gap between the evidence period and the current decision, ask what later events or changes the provider attests to and record the limits. A certificate, audit report, self-assessment, or bridge letter supports only the claims its wording and scope cover.

Keep the assurance document, scope statement, assessment criteria, auditor or assessor identity and opinion, exceptions, provider response, later-period evidence, and customer assessment together. Record which provider claims were accepted, qualified, or rejected; why; and which provider remediation or customer control remains necessary.

Trace each relied-on claim to a page, control, system description, exception response, or other precise location in the evidence. Provider evidence does not show that the customer enabled a setting, reviewed access, collected customer logs, tested restoration, or met a legal duty. Link customer-operated controls to their own configuration exports, tickets, logs, test results, and approvals.

ISO/IEC 27017 does not prescribe the customer's internal approver titles. As a practical model, the cloud service owner can accept the provider-evidence assessment with security and supplier-assurance input. The person accepting residual risk must have the authority assigned by the customer's governance process.

Include privacy, legal, resilience, or regulatory owners when the evidence is being used to support their requirements. Do not treat the provider, its auditor, or a certificate issuer as approving the customer's use of the service.

ISO/IEC 27017:2015 sets no universal evidence cycle. Review when a new report is issued and when the provider entity, service, region, upstream or subservice organization, architecture, agreement, assurance scope, auditor conclusion, or material exception changes.

Reassess after a relevant incident or when bridge coverage expires. If current evidence is unavailable, document the gap, interim evidence, compensating controls, owner, deadline, and risk decision.