ISO/IEC 27017:2026

International

v2026

5 domains

47 controls

Verified

ISO/IEC 27017:2026 is a compliance framework from International with 5 domains and 47 controls. The largest domains are Organizational controls, cloud service specific guidance – ISO/IEC 27017:2026 (21 controls), Technological controls, cloud service specific guidance – ISO/IEC 27017:2026 (18 controls), Guidance for using this document – ISO/IEC 27017:2026 (5 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (5)

Guidance for using this document – ISO/IEC 27017:2026

5 controls

Organizational controls, cloud service specific guidance – ISO/IEC 27017:2026

21 controls

Controls in the Organizational controls, cloud service specific guidance – ISO/IEC 27017:2026 domain of ISO/IEC 27017:2026 — 21 controls
Code	Title	Description
iso-iec-27017-2026::5.1	Policies for information security	The cloud service customer should define a topic-specific policy on its use of cloud services, consistent with the risk...
iso-iec-27017-2026::5.11	Return of assets	Assets of the cloud service customer that are on the cloud service provider's premises are to be removed, and returned w...
iso-iec-27017-2026::5.13	Labelling of information	The customer should label information according to its classification before and while it is in a cloud service, using l...
iso-iec-27017-2026::5.16	Identity management	Registration and de-registration of the customer's users of the cloud service should be supported by provider functions;...
iso-iec-27017-2026::5.17	Authentication information	How the secret authentication information of the customer's users is handled by the service should be explained by the p...
iso-iec-27017-2026::5.18	Access rights	Access rights of the customer's users to the cloud service should be manageable by the customer through functions the pr...
iso-iec-27017-2026::5.19	Information security in supplier relationships	The customer should include cloud service providers in its supplier security policy, recognising that a cloud service pr...
iso-iec-27017-2026::5.2	Information security roles and responsibilities	The cloud service customer should define the information security roles and responsibilities for its use of cloud servic...
iso-iec-27017-2026::5.20	Addressing information security within supplier agreements	The agreement between customer and provider should set out the information security requirements for the cloud service,...
iso-iec-27017-2026::5.21	Managing information security in the ICT supply chain	The provider should identify the peer cloud services and suppliers on which the cloud service depends and should tell th...
iso-iec-27017-2026::5.23	Information security for use of cloud services	The ISO/IEC 27002:2022 control that requires processes for the acquisition, use, management and exit from cloud services...
iso-iec-27017-2026::5.24	Information security incident management planning and preparation	Incident management responsibilities and procedures should be allocated between customer and provider for each cloud ser...
iso-iec-27017-2026::5.28	Collection of evidence	The provider should describe what evidence it can make available to the customer after an incident in the cloud service,...
iso-iec-27017-2026::5.31	Legal, statutory, regulatory and contractual requirements	The customer should identify the legal, regulatory and contractual requirements that apply to its information when proce...
iso-iec-27017-2026::5.32	Intellectual property rights	The provider should set out the intellectual property rights that apply to the cloud service and to the customer's conte...
iso-iec-27017-2026::5.33	Protection of records	Records the customer must retain need protection the customer can verify: the provider should give information about how...
iso-iec-27017-2026::5.35	Independent review of information security	Independent review of the provider's security is what lets a customer rely on a cloud service without auditing it: the p...
iso-iec-27017-2026::5.37	Documented operating procedures	Procedures for administrative operations of a cloud computing environment are to be defined, documented and monitored. T...
iso-iec-27017-2026::5.38	CLD - Shared roles and responsibilities within a cloud computing environment	Responsibilities for information security in the use of a cloud service are shared, and the standard requires that they...
iso-iec-27017-2026::5.39	CLD - Agreement on the roles and responsibilities of the cloud service partner	New cloud service extended control in the second edition: where a cloud service partner (a party that supports or is aux...
iso-iec-27017-2026::5.9	Inventory of information and other associated assets	The cloud service customer's asset inventory should record the information and assets it holds in each cloud service, so...

People controls, cloud service specific guidance – ISO/IEC 27017:2026

2 controls

Controls in the People controls, cloud service specific guidance – ISO/IEC 27017:2026 domain of ISO/IEC 27017:2026 — 2 controls
Code	Title	Description
iso-iec-27017-2026::6.3	Information security awareness, education and training	Awareness and training should cover the cloud-specific behaviours each party's people need. For the customer this means...
iso-iec-27017-2026::6.8	Information security event reporting	The provider should give the customer a mechanism to report information security events it observes in the cloud service...

Physical controls, cloud service specific guidance – ISO/IEC 27017:2026

1 controls

Controls in the Physical controls, cloud service specific guidance – ISO/IEC 27017:2026 domain of ISO/IEC 27017:2026 — 1 controls
Code	Title	Description
iso-iec-27017-2026::7.14	Secure disposal or re-use of equipment	The provider should arrange for secure disposal or re-use of equipment that has held customer information, so that custo...

Technological controls, cloud service specific guidance – ISO/IEC 27017:2026

18 controls

Controls in the Technological controls, cloud service specific guidance – ISO/IEC 27017:2026 domain of ISO/IEC 27017:2026 — 18 controls
Code	Title	Description
iso-iec-27017-2026::8.13	Information backup	The provider should specify the backup capabilities it offers, including scope, frequency, retention, protection of the...
iso-iec-27017-2026::8.15	Logging	Event logging in a cloud service is split between the parties. The provider should give the customer logging capability...
iso-iec-27017-2026::8.16	Monitoring activities	The cloud service customer is to have the capability to monitor specified aspects of the operation of the cloud services...
iso-iec-27017-2026::8.17	Clock synchronization	The provider should synchronise the clocks of the cloud service to a reference time source and should tell the customer...
iso-iec-27017-2026::8.18	Use of privileged utility programs	The provider should specify which utility programs able to override system and application controls may be used in the c...
iso-iec-27017-2026::8.2	Privileged access rights	Privileged access in a cloud service sits on both sides. The customer should control the privileged rights it holds over...
iso-iec-27017-2026::8.20	Networks security	When virtual networks are configured, the consistency of configurations between virtual and physical networks is to be v...
iso-iec-27017-2026::8.22	Segregation of networks	The provider should enforce segregation of network access between tenants of the cloud service and between the provider'...
iso-iec-27017-2026::8.24	Use of cryptography	The provider should describe the cryptographic controls the cloud service offers, the circumstances in which they are us...
iso-iec-27017-2026::8.25	Secure development life cycle	Where the customer develops applications on a cloud service, its secure development policy should address the cloud envi...
iso-iec-27017-2026::8.26	Application security requirements	The customer should specify its information security requirements for a cloud service before selecting it, drawing on it...
iso-iec-27017-2026::8.3	Information access restriction	Restricting access to the customer's information in the cloud service is the customer's decision and the provider's mech...
iso-iec-27017-2026::8.32	Change management	Changes to the cloud service that could adversely affect it should be notified: the provider should give the customer in...
iso-iec-27017-2026::8.35	CLD - Segregation in virtual computing environments	A customer's virtual environment running on a cloud service is to be protected from other customers of the service and f...
iso-iec-27017-2026::8.36	CLD - Detection and prevention of unauthorized use of cloud services	New cloud service extended control in the second edition: the organization should detect and prevent the use of cloud se...
iso-iec-27017-2026::8.6	Capacity management	The provider should monitor the capacity of the cloud service so that it can meet the agreed levels of service for its c...
iso-iec-27017-2026::8.8	Management of technical vulnerabilities	Technical vulnerabilities in a cloud service are divided between what the provider patches and what the customer patches...
iso-iec-27017-2026::8.9	Configuration management	Virtual machines in a cloud computing environment are to be hardened to meet business needs. Whichever party configures...

What is ISO/IEC 27017:2026 and who does it apply to?

ISO/IEC 27017:2026 is a compliance framework from International with 5 domains and 47 controls. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does ISO/IEC 27017:2026 actually require?

ISO/IEC 27017:2026 has 47 controls organised across 5 domains. The largest domains are Organizational controls, cloud service specific guidance – ISO/IEC 27017:2026 (21 controls), Technological controls, cloud service specific guidance – ISO/IEC 27017:2026 (18 controls), Guidance for using this document – ISO/IEC 27017:2026 (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of ISO/IEC 27017:2026 do I already cover?

ISO/IEC 27017:2026 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement ISO/IEC 27017:2026?

Start your ISO/IEC 27017:2026 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO/IEC 27017:2026 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 47 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 694 frameworks.

Get Started Free →

Free forever — no credit card required