Sign in

ISO 27017

ISO/IEC 27017 Cloud Services Information Security Controls — ISO/IEC JTC 1/SC 27

Also known as: ISO/IEC 27017, ISO 27017:2015, ISO 27017:2026, ISO IEC 27017

Official site Official change log Subscribe to ISO 27017 (RSS)

This is a paid standard. We publish the fact of a change, its version and date, and a link to the publisher — the text itself is not reproduced.

Current version
ISO/IEC 27017:2026
Published 27 July 2026. source
Status
In force
Next deadline
None announced
Who must comply
Cloud service providers and cloud service customers, for all cloud deployment models, including private cloud. source
How it is assessed
In Italy, assessed as an extension of an ISO/IEC 27001 certification, with extra audit time, rather than with a separate certificate. source
Written by
Published jointly by ISO and IEC (committee ISO/IEC JTC 1/SC 27) as voluntary guidance. source source
Enforced by
A voluntary standard; it sets no contractual, legal or statutory requirements. source
Last change

Guidance on information security controls for cloud services, building on ISO 27002 and addressed to both cloud providers and their customers.

Recent changes

Nothing changed in the last 90 days. Sign in to read further back.

Key dates

No upcoming dates
  1. ISO/IEC 27017:2026 is published and the 2015 edition is withdrawn

Version history

  1. ISO/IEC 27017:2026 Major versionCurrent

    Second edition: cloud guidance for relevant controls of ISO/IEC 27002:2022, plus extra cloud-specific controls; replaced the 2015 edition. source

  2. ISO/IEC 27017:2015 Major version

    First edition: implementation guidance for ISO/IEC 27002 controls and additional controls for cloud services, for both providers and customers. source

Who it applies to

Both sides of a cloud service, the provider and the customer. It is voluntary guidance that some public buyers require.

Providers and customers
Gives controls and guidance for cloud service customers (CSCs) and cloud service providers (CSPs). source
Deployment models
Applies to all cloud deployment models, including private cloud, where some adjustments to internal relationships can be needed. source
Legal status
ISO standards are voluntary and contain no contractual, legal or statutory requirements; national laws take precedence. source
Italy, public sector
Italy's cybersecurity agency (ACN) requires ISO/IEC 27001 certification with the ISO/IEC 27017 and 27018 extensions from IT services sold to public bodies through the central marketplace, including services that are not cloud. source

How compliance is assessed

In Italy, assessed as an extension of an ISO/IEC 27001 certification, with extra audit time, rather than with a separate certificate.

Extension
Clarifications issued in mid-2025 in Italy stated that ISO/IEC 27017 and 27018 are ISO/IEC 27001 extensions and certification bodies should not issue specific certificates for them. source
Audit time in Italy
Accredia, Italy's accreditation body, requires one extra audit day for each extension and each certification phase. source

Enforcement and penalties

A voluntary standard; it sets no contractual, legal or statutory requirements.

Legal force
ISO standards are voluntary and contain no contractual, legal or statutory requirements. source

Documents

  1. Standard ISO/IEC 27017:2026 (catalogue entry; paid standard)
  2. Standard ISO/IEC 27017:2015 (withdrawn edition, catalogue entry)

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to ISO 27017 (RSS)