ISO/IEC 27017:2026
People controls, cloud service specific guidance – ISO/IEC 27017:2026

ISO/IEC 27017:2026 6.3: Information security awareness, education and training

What does 6.3 require?

Carried first-edition guidance. The CSC adds to its programme for cloud service business managers, administrators, integrators and users (employees and contractors) the standards and procedures for using cloud services, the security risks of cloud services and how they are handled, the system and network environment risks of cloud use, and applicable legal and regulatory points, and extends it to managers and supervisors in business units. The CSP gives its staff, and requires its contractors to give theirs, awareness and training on handling CSC data and cloud service derived data, which can be confidential or restricted, including by regulation, in how the CSP may access and use it.

Maintained by Gerard Blokdyk

Other controls in People controls, cloud service specific guidance – ISO/IEC 27017:2026

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.