Who is it for?

The ISO 27017 standard – based on ISO 27001 (which standardises information security management systems) – was developed for the benefit of all organisations (regardless of the nature of their activities, size or legal form) that provide cloud services. These include:

• private companies,
• public institutions,
• government bodies,
• non-profit organisations.

The ISO 27017 standard concerns information security in cloud computing in the broadest sense. It therefore also includes recommendations for service recipients. It enables the security of the relationship between the provider and customers to be defined.

A prerequisite for obtaining ISO 27017 certification is existing or concurrent certification of an information security management system compliant with ISO 27001.

Information about the standard

ISO 27017 (actually ISO/IEC 27018, as it is also a standard of the International Electrotechnical Commission) is an international standard providing guidance on the provision and use of cloud computing services. It is based on ISO 27002 (which sets out principles for establishing, implementing, operating, monitoring, reviewing, maintaining and improving information security management systems), but extends its guidelines and introduces seven new control areas concerning:

• responsibilities in the relationship between the cloud service provider and the customer,
• the deletion (or return) of information following the termination of the relationship,
• the separation and protection of the customer’s virtual environment,
• the configuration of virtual machines,
• procedures and actions taken in connection with cloud data processing,
• the monitoring of customer activity when using cloud services,
• the adaptation of the virtual network and cloud computing environment to ensure the highest security standards.

The ISO 27017 standard is unique in the field of information technology, as it sets out requirements not only for providers but also for customers of cloud services. This minimises the risk associated with the fact that data stored in the cloud is exposed to a particularly wide range of threats.

Benefits of implementation

Implementing the ISO 27017 standard enables an increase in the security level of information stored and processed in the cloud. It also allows for continuous verification and rapid response to potential threats. A company that opts for ISO 27017 certification can expect an increase in trust from customers and business partners who want a guarantee that their data (including personal data) is well protected.

ISO 27017 certification has a very positive impact on a company’s image, thereby increasing its growth potential. By implementing the highest standards of information security in cloud computing, a company gains:

• the opportunity to operate in global markets where ISO 27017 is a widely recognised standard,
• a competitive advantage in marketing activities – certification sets the company apart from those that have not implemented ISO 27017,
• protection of the company’s reputation, which, in the event of information security breaches (particularly involving customers’ personal data), is particularly vulnerable to the spread of negative publicity.

Although the implementation of ISO standards is not a legal obligation, a breach of personal data protection is subject to criminal liability. As ISO 27017 ensures that information security procedures comply with applicable regulations, the application of the practices described in the standard minimises the risk of potential penalties.