ISO/IEC 27017 gives implementation guidance for information security controls in cloud services, plus seven additional cloud-specific controls, including shared roles and responsibilities, removal of customer assets, virtual machine hardening and administrator operational security.
We fold ISO 27017 into your ISMS rather than running it as a separate project: your Statement of Applicability, risk assessment and supplier controls are extended to cover cloud services, and we prepare a customer-facing shared responsibility matrix.
Who it is for
- SaaS, PaaS and IaaS providers
- Managed service providers hosting customer workloads
- Enterprises with significant cloud estates
What you gain
- Clarifies shared responsibility with customers
- Adds cloud-specific assurance to your ISO 27001 certificate
- Answers cloud sections of security questionnaires
Your path to certification
Gap assessment
We compare what you do today with every requirement and control, then give you a prioritised gap report and a realistic timeline.
Design and documentation
Scope, policies, procedures, risk methodology and records, written to fit how your teams actually work, not a template binder.
Implementation and training
We help owners put controls in place, train the people who run them and start collecting evidence.
Internal audit and management review
An independent internal audit and a structured management review prove the system works before the certification body looks at it.
Certification audit support
We prepare you for Stage 1 and Stage 2 with your chosen accredited certification body and help close any findings quickly.
Surveillance and continual improvement
Optional managed support keeps evidence current through annual surveillance audits and the three-year recertification.