ISO/IEC 27017: Cloud Security Controls — What Cloud Providers and Customers Must Know
As organisations migrate workloads to cloud environments, the shared responsibility model creates a complex question: who is responsible for which security controls? ISO/IEC 27017:2015 answers this question with an internationally recognised code of practice for cloud security, providing guidance for both cloud service providers (CSPs) and cloud service customers (CSCs).
What ISO 27017 Covers
ISO 27017 is a code of practice — a guidance standard, not a requirements standard — that provides additional information security controls for cloud environments, supplementing ISO 27001 and ISO 27002. It introduces seven cloud-specific controls not present in ISO 27002, covering:
- Shared roles and responsibilities between cloud provider and customer
- Asset management for cloud services
- Removal and return of cloud service customer assets
- Segregation in virtual computing environments
- Monitoring of cloud services
- Virtual networking security
- Protection and separation of the administrator's operational environment
Beyond these seven new controls, ISO 27017 provides cloud-specific implementation guidance for the existing ISO 27002 controls — explaining how each control applies in cloud contexts for both the provider and the customer.
The Shared Responsibility Model in ISO 27017
One of ISO 27017's most valuable contributions is its structured approach to shared responsibility. For each control domain, the standard distinguishes between controls that are the provider's responsibility, the customer's responsibility, or shared.
Provider responsibilities typically cover physical security, underlying infrastructure security, hypervisor security, network infrastructure, and the security of the cloud platform itself.
Customer responsibilities typically cover identity and access management within the cloud environment, data classification and encryption of their own data, application-level security, security monitoring of their cloud deployments, and incident response for their own applications.
Shared responsibilities — areas requiring coordination between both parties — include vulnerability management, security incident communication, and change notification.
Clear documentation of this division in contracts and technical specifications reduces the risk of security gaps caused by each party assuming the other is handling a particular control.
Who Benefits from ISO 27017
Cloud Service Providers seeking to differentiate on security and demonstrate to enterprise customers that their platform meets internationally recognised cloud security standards. An ISO 27017 certificate is increasingly requested in enterprise procurement questionnaires alongside SOC 2 Type II.
Enterprises using cloud services that want a structured framework for evaluating their cloud providers' security controls and understanding their own responsibilities within the shared model. ISO 27017 alignment helps enterprise cloud teams close the gaps that often exist in multi-cloud environments.
Regulated industries — financial services, healthcare, government — where regulators require demonstration of cloud security controls and the shared responsibility model must be explicitly documented in risk assessments and vendor contracts.
Implementing ISO 27017 Alongside ISO 27001
ISO 27017 is most commonly implemented as an extension to an existing ISO 27001 ISMS. The implementation path includes:
Cloud asset inventory: Documenting all cloud services used, their classification, and the data types they process. This feeds both ISO 27001 asset management and ISO 27017's cloud-specific asset controls.
Shared responsibility documentation: For each significant cloud service, documenting the division of security responsibilities between provider and customer — often in an annex to the service agreement or in internal cloud governance documentation.
Virtual environment controls: Implementing and evidencing controls for segregation between virtual machines, virtual networks, and storage — particularly in multi-tenant environments.
Cloud-specific monitoring: Configuring cloud-native monitoring (AWS CloudTrail, Azure Monitor, GCP Cloud Logging) and ensuring that cloud activity is captured, retained, and reviewed as part of the ISMS monitoring process.
Provider assessment: Obtaining and reviewing cloud providers' ISO 27017 certificates or equivalent security documentation as part of the supplier management process.
Why Organisations Choose Savadub
Deep GRC Expertise
Our team holds practitioner-level expertise across every major compliance framework — not just theoretical knowledge, but hands-on implementation experience across multiple industries and organisation sizes.
Engineers, Not Just Consultants
We implement controls, not just recommend them. Our GRC engineers configure the systems, write the integrations, and build the monitoring pipelines that make compliance operational.
Global and African Regulatory Coverage
We understand both the global frameworks and the African regulatory environment — NDPR, NDPA, CBN directives, NITDA guidelines, and regional data protection laws — making us uniquely positioned for organisations operating across Africa and internationally.
Internal and External Audit Capability
We provide both embedded internal audit functions and independent third-party audit support, including CPA-accredited audit coordination for SOC examinations.
End-to-End Engagement
From initial gap assessment through certification, continuous monitoring, and ongoing compliance management — we are your long-term GRC partner, not a one-time consultant.
Industries We Serve
Financial Services · Healthcare · Technology & SaaS · Manufacturing · Logistics & Trade · Government & Public Sector · Energy & Critical Infrastructure · Education & EdTech · Media & Broadcasting · Retail & E-Commerce · Professional Services · Food & Beverage
Deliverables You Receive
Working with Savadub, every engagement delivers a concrete set of outputs:
- Gap Assessment Report — prioritised findings with effort estimates and risk ratings
- Compliance Roadmap — milestone-based plan from current state to certification or attestation
- Risk Register — organisational risk register with treatment plans
- Policy Pack — all required policies authored, reviewed, and approved
- Technical Control Implementation Evidence — configurations, screenshots, and audit trails
- Internal Audit Report — independent assessment of control effectiveness
- Audit Evidence Repository — organised, auditor-ready evidence collection
- Executive Summary Presentation — board and leadership-ready compliance status
- Remediation Tracker — structured tracking of open findings and closure evidence
- Continuous Monitoring Setup — ongoing CCM pipeline for post-certification compliance
Get Started with Savadub
Savadub's GRC practice combines deep compliance expertise with technical engineering capability. We don't just advise — we build, implement, and operate your compliance program from the ground up.
Book a free GRC consultation with our team. We will review your current posture, identify your most critical gaps, and give you a clear, costed roadmap to compliance.
Contact us:
- Email: grc@savadub.com
- Phone: +234 816 734 2201
- WhatsApp: +234 903 234 8435
- Website: www.savadub.com
