ISO/IEC 27017

Extending ISO/IEC 27001

into the Cloud
A Whitepaper
Cloud customers are concerned about security—it remains a key reason why
organizations hesitate to adopt cloud services despite the flexibility and scalability
the cloud can offer. A key concern focuses around the ability of cloud service
providers (CSPs) to treat customer data with sufficient care and attention.

The main elements of this are the worries that data and offers more peace of mind for potential cloud
could end up in the wrong hands and what control customers. Typical cloud standards and technical
does a customer have over careless operators. But standards that address the cloud provider controls and
there are other concerns too: issues such as customer guidance aimed at the cloud service provider. What’s
identity, segregation of assets on virtual servers and unique and extremely helpful about ISO/IEC 27017
what happens to assets in the event of a CSP going out is that it provides both the CSP and cloud service
of business are also issues that play on potential cloud customer with guidance and advice. In addition to
users’ minds. ensuring services are safe, ISO/IEC 27017 also aims to
educate customers on what they should want from
The ISO 27001 series addresses some of these concerns
their host in the cloud.
but a new standard, ISO/IEC 27017 Information
technology — Security techniques, goes further

The standard provides cloud-based guidance on 37 of the controls in ISO/IEC 27002 but also features
seven new controls.

• CLD.6.3.1: Agreement on shared or divided • CLD.12.4.5: How the capabilities of the provider
responsibilities between the customer and provider enable the customer to monitor activity within a
around information security roles associated with cloud computing environment.
cloud services have to be clearly laid out, recorded
and communicated.
• CLD.13.1.4: Consistent configurations should be made
so that the virtual network environment is in line
• CLD.8.1.5: Addresses how assets are returned with the information security policy of the physical
or removed from the cloud when the contract/ network.
agreement between the customer and provider is
terminated.

• CLD.9.5.1: The provider has to protect and separate

the customer’s virtual environment from other
customers and external parties.

• CLD.9.5.2: The customer and provider must ensure

virtual machines are configured and hardened to
meet the needs of the organization.

• CLD.12.1.5: The customer’s responsibility to

define, document and monitor the administrative
operations and procedures associated with the
cloud environment and the CSP’s requirement to
share documentation about critical operations and
procedures as and when customers require it.

3
Roles and responsibilities
Ambiguity in roles and in the “Data and files on the cloud service provider's systems created
definition and allocation of or modified during the use of the cloud service, can be critical to
responsibilities related to issues the secure operation, recovery and continuity of the service. The
such as data ownership, access ownership of all assets, and the parties who have responsibilities
control, and infrastructure for operations associated with these assets, such as backup and
maintenance can give rise to recovery operations, should be defined and documented. Otherwise,
business or legal disputes; especially there is a risk that the cloud service provider assumes that the cloud
when dealing with third parties. As service customer performs these vital tasks (or vice versa), and a loss
the standard states: of data can occur.”

Essentially, the standard requires that it’s clearly laid out which party is responsible for what from the outset.

Security controls
It’s not only the separation of responsibilities that the been implemented and, most importantly, what types of
standard helps define: ISO/IEC 27017 also goes into controls have been introduced. This information should
much more detail about the type of security controls be shared with the cloud customer before any contract
that service providers should be implementing – is signed to help alleviate any potential issues in the
helping reduce the barriers to cloud adoption. future.
ISO/IEC 27017 offers a way for cloud service providers In cases where independent audits aren’t practical or
to indicate the level of controls that have been would pose a greater risk to information security , the
implemented. This means documented evidence— standard does provide an option for CSPs to self-assess.
backed up by independent sources like certification to When this is the case, the CSP must tell customers that
certain standards—show that appropriate policies have they have self-assessed.

Cryptography
There’s also guidance about where they may be some additional should both parties assure each
any cryptography being used. regulatory guidelines. other that the network is being
This applies to the customer protected, they should also be able
Customers should also be upfront
and the provider as both have to assure each other that there’s
about the type of cryptography
responsibilities in this area. The compatibility between the two
that they’re using – and they ought
provider should tell the customer systems. And, crucially, it should
be using cryptography if the risk
how it’s using cryptography and be determined whether these
analysis suggests that it’s needed.
help customers apply protection of controls apply to data at rest, in
In fact, this is the sort of dispute, or
their own. It should also consider transit or both, as this has caused
misunderstanding that underpins
special cases, such as health data, misunderstandings before.
the need for the standard. Not only

4
Customer relationship
The standard extends requirements beyond security devices that customers need to be wary of, but
technology and also lays out guidelines for training. rather whether staff are following all of the appropriate
Many customers are happy about cloud providers’ measures. The new standard not only sets out that
infrastructure but are wary about the level of support. providers should be supplying awareness and training
for employees and contractors, but also stipulates that
There is, after all, plenty of evidence to suggest
the training should cover regulatory requirements,
employees are often the weak point in any
organization’s security measures. It’s not just faulty customer access and specific requests.

Asset ownership
Who owns what in the cloud can be acceptable use of and return of
a point of confusion. The standard assets. The new standard also lays
suggests that there be an inventory out parameters for the safe disposal
made of assets that are stored in of customer assets so that sensitive
the cloud and also refers back to the data isn’t simply dumped in virtual
guidance information specified in dustbins
ISO/IEC 27002 on the ownership,

Who benefits?
The simple answer is: everyone. Well everyone associated with the cloud.
The road to cloud can be paved with misunderstandings prove to be very helpful as an organization makes
and apprehension. Any organization entrusting sensitive decisions about adopting cloud and which partners are
customer data to a third party has come to know there suited to their needs.
are grey areas where rights and responsibilities have
CSPs that choose to implement ISO/IEC 27017 will also
not been clearly defined. There’s a lot that’s been taken
benefit by knowing they’re offering a secure solution
on trust and that’s not necessarily the best recipe for
that their customers can trust, which goes a long way
success.
in building a cloud-based relationship. And, of course,
CIOs and IT managers will be encouraged by the by working with their customers through their adoption
changes to their relationships with CSPs supported process ISO/IEC 27017 protects themselves from
by the standard as they introduce a real degree of harmful accusations or law suits that may disrupt their
assurance to cloud computing security. Overview and business and damage their brand.
implementation training around ISO/IEC 27017 may
© BSI Group BSI/UK/884/SC/0616/EN/BLD

Find out more

Call: +44 (0)345 080 9000
Visit: bsigroup.com
1