Cloud security that doesn’t leave you high and dry

What it is

ISO 27017 provides additional guidance for information security controls in cloud environments. It builds directly on ISO 27001 to address the unique risks inherent to cloud services, such as multi-tenancy, virtual machine isolation, and the critical “who is securing what” dilemma-helping you lock down your cloud infrastructure with total clarity and confidence

When to use it

Use this add-on when your organization provides or relies heavily on cloud services and needs to make cloud security responsibilities explicit. It is especially relevant when enterprise customers or auditors ask exactly how your cloud infrastructure is protected, or how operational responsibility is divided between you and your cloud provider.

What it adds

It extends your ISMS with cloud-specific control guidance and makes shared responsibility models completely transparent without reinventing your management system. This add-on upgrades your Instant 27001 system by providing:

• Tailored implementation guidelines for 37 existing Annex A controls, specifically optimized for both cloud service providers and cloud customers.
• 7 brand-new, cloud-focused controls that seamlessly match the existing structure of Instant 27001:
  • CLD.6.3.1: Shared roles and responsibilities within a cloud computing environment
  • CLD.8.1.5: Removal of cloud service customer assets
  • CLD.9.5.1: Segregation in virtual computing environments
  • CLD.9.5.2: Virtual machine hardening
  • CLD.12.1.5: Administrator’s operational security
  • CLD.12.4.5: Monitoring of cloud services
  • CLD.13.1.4: Alignment of security management for virtual and physical networks

Add-ons can be used together with Instant 27001 for Confluence or Microsoft 365 (ISOPlanner). Instructions for installation and implementation are provided.

Relevant for

• Cloud service providers
• SaaS companies
• Hosting providers
• Platform providers
• Organizations with cloud-heavy infrastructure

Pricing

All prices are excluding applicable taxes and/or platform subscription fees.