ISO/IEC 27017 is a code of practice for information security controls in cloud services. It extends general control guidance with cloud-specific responsibilities for providers and customers, including shared responsibility, virtual environment separation, administrative access and removal of customer data at service end.
How ISO/IEC 27017 Fits Into Cloud Security Governance
ISO/IEC 27017 is best understood as a cloud-specific control guidance layer on top of broader information security practice. Its value is that it translates general security intent into responsibilities that matter in shared cloud environments, where providers and customers often control different parts of the stack.
That matters because cloud security failures frequently arise from unclear ownership, especially around configuration, administrative actions, tenant separation, and data handling at service end. ISO 27017 helps define where a cloud provider’s duties stop and a customer’s duties begin, so security expectations are not lost in the shared-responsibility model.
Cloud Provider and Customer Responsibilities
The standard is useful precisely because cloud services blur traditional control boundaries. In practice, it helps organisations decide who is responsible for which control objective, rather than assuming that “the cloud provider handles it” or that the customer can configure everything independently.
This division is especially important for security operations, procurement, and contract review. A buyer needs to understand whether a control is delivered natively by the provider, must be configured by the customer, or depends on both parties working together. The standard gives a common vocabulary for that discussion and reduces ambiguity in cloud governance.
Key Control Themes in Cloud Environments
ISO/IEC 27017 highlights issues that are easy to underestimate in cloud deployments. Shared environment separation, administrative access, and the secure removal of customer data at the end of service all become more complex when infrastructure is abstracted and operational control is distributed.
Those themes are closely related to the practical reality of cloud trust boundaries. For example, admin access may be highly privileged but narrowly scoped, virtual environment separation must prevent one tenant from interfering with another, and end-of-service data handling must account for retention, deletion, and residual access risks.
- Shared responsibility becomes explicit instead of implied.
- Tenant and virtual environment separation are treated as security requirements, not architecture assumptions.
- Administrative access is recognised as a high-trust control point.
- Customer data disposal at service end becomes part of the security lifecycle.
Why It Matters for Assurance and Cloud Risk Management
The practical benefit of ISO/IEC 27017 is assurance. It helps organisations ask whether cloud controls are actually defined, implemented, and evidenced in a way that matches the service model they are buying or operating. That makes it useful for governance reviews, supplier due diligence, and internal control mapping.
It also reduces the chance that cloud adoption creates invisible control gaps. When security responsibilities are not documented clearly, teams can miss monitoring, access control, segregation, or data deletion obligations until an incident or audit exposes the gap. ISO/IEC 27017 gives structure to that conversation without replacing the underlying security programme.
Risk and Threat Considerations
Cloud services introduce risk when responsibility is assumed rather than documented, especially around access boundaries, tenant isolation, and data lifecycle controls. Weak interpretation of the shared-responsibility model can leave critical controls unowned, which creates exposure even when the platform itself is well designed.
Failure mechanism: Misaligned expectations between provider and customer can lead to excessive administrative access, inadequate tenant separation, or incomplete data deletion at service end, leaving residual access or exposure paths.
Impact: The result can be data leakage, cross-tenant exposure, unauthorized administrative activity, or failure to dispose of customer data safely when the service relationship ends.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| ISO/IEC 27001:2022 | A.5.23 — Information security for use of cloud services | ISO 27017 extends cloud control guidance that aligns directly with cloud service governance |
| A.5.15 — Access control | Cloud admin access and privilege boundaries are central to ISO 27017 guidance | |
| A.8.24 — Use of cryptography | Cloud service handling of customer data often depends on protective technical controls in shared environments | |
| Recommendation — Map cloud service responsibilities and verify shared-control ownership before onboarding or renewing providers. Define and enforce cloud access rules for provider and customer roles with least privilege. Apply protected handling requirements to cloud-stored data where service responsibilities are split. | ||
| NIST CSF 2.0 | GV.SC-05 — Supply Chain Risk Management | Cloud provider responsibility and service end handling are supplier-governance issues |
| PR.AA-01 — Identities and credentials are issued, managed, verified, revoked, and audited | Administrative access in cloud services depends on credential and privilege governance | |
| PR.DS-01 — Data-at-rest is protected | Customer data disposal and retention in cloud services rely on lifecycle data protection | |
| Recommendation — Assess cloud suppliers for shared-responsibility clarity, exit obligations, and control evidence. Govern cloud admin credentials and revoke access promptly when roles or services change. Protect stored cloud data and confirm secure disposal at service end. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Cloud administrative access should be limited to the minimum required by role and service model |
| SC-7 — Boundary Protection | Virtual environment separation is a boundary and segmentation concern in cloud services | |
| MP-6 — Media Sanitization | End-of-service customer data removal maps to secure disposal expectations | |
| Recommendation — Restrict cloud administrative actions to the minimum privileges needed. Validate cloud boundary controls that separate tenants and isolate workloads. Verify secure sanitization or deletion before cloud service termination. | ||
| CIS Controls v8 | CIS-3 — Data Protection | Cloud data lifecycle and disposal controls are a core part of protecting customer information |
| Recommendation — Define how cloud data is retained, protected, and deleted across the service lifecycle. | ||
Practitioner Guidance
Governance implication: Use ISO/IEC 27017 as a control-ownership reference when reviewing cloud contracts, shared-responsibility matrices, and security baselines. The standard is most useful when it is tied to specific services, so the control expectation is clear for each platform and workload.
Practitioner takeaway: Treat the standard as a way to remove ambiguity, not as a substitute for cloud-specific technical validation and operational monitoring.
Related resources from NHI Mgmt Group
- Who is accountable for ISO/IEC 42001 evidence and AI access control?
- Why does ISO/IEC 27001:2022 matter for IAM and NHI programmes?
- Why do organisations choose ISO/IEC 27001 when they already have other security frameworks?
- What is the difference between ETSI TS 119 461 and ISO/IEC 30107 in identity proofing?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org