ISO/IEC 27017 FAQ Virtualization Responsibilities

Apply three separate tests. First, if the service is multi-tenant, CLD.9.5.1 assigns the provider logical segregation of customer data, virtualized applications, operating systems, storage, and networks between tenants and from the provider's internal administration. The customer should define its segregation requirements and obtain evidence for the named service, tier, region, and architecture. A dedicated service may change the tenant-isolation test, but it does not remove access-control, hardening, administration, or network-policy duties.

Second, identify who configures each virtual machine. CLD.9.5.2 tells customers and providers to harden the machines they configure for business needs, including allowing only needed ports, protocols, and services and applying appropriate measures such as anti-malware and logging. In an IaaS service, the customer commonly configures guest machines; in a managed platform or SaaS service, the provider may control the layer. Allocate images, snapshots, dormant or offline instances, guest operating systems, hypervisor exposure, self-service portals, and backups separately because the service label does not settle every layer.

Third, map the virtual network. CLD.13.1.4 assigns the provider the policy and verification duty: the provider should define a virtual-network security policy consistent with its physical-network policy and ensure that virtual configuration matches it regardless of how the configuration is created. The standard notes that the party configuring the virtual network can vary by service type. Customer-configurable rules still need a named customer owner and evidence, but the provider's stated consistency duty should not be reassigned solely because the customer enters the rule.

Document customer critical operations whose failure could cause unrecoverable damage, including installing, changing, or deleting virtual servers, networks, or storage; terminating cloud use; and backup or restoration. CLD.12.1.5 says the customer procedure should specify supervisor monitoring, while the provider should supply critical-operation documentation to customers who require it.

Keep the current service architecture, tenancy statement, layer-by-layer responsibility matrix, provider segregation assurance, customer and provider virtual-machine baselines where available, image controls, snapshot and dormant-instance inventory, virtual and physical network-policy mapping, privileged-operation logs, critical-operation procedure, and backup and restoration results.

Sample one active virtual machine, image or snapshot, virtual-network rule set, isolation control claim, and critical administrative operation where each exists. Record the service and resource, configuring party, expected baseline or policy, observed result, evidence period, owner, reviewer, exception, follow-up owner, and due date.

ISO/IEC 27017 allocates customer and provider duties but does not prescribe internal approval titles. As a practical model, the cloud service owner can approve the layer allocation; platform, network, image, backup, and security owners can accept customer activities; and supplier management can maintain provider commitments and assurance.

A supervisor should monitor the customer critical operations identified by the procedure. Send any unowned layer or unsupported provider assumption to the authorized risk owner.

ISO/IEC 27017:2015 sets no universal virtualization-review interval. Review when the tenancy or service model, hypervisor or orchestration platform, image pipeline, network architecture, provider feature, agreement, or responsibility boundary changes.

Also review after isolation findings, unexpected exposure, failed restoration, destructive administrative error, or stale-image discovery. Update the architecture, matrix, baseline, procedure, and risk treatment together.