The second edition of ISO/IEC 27017:2026 – key changes to cloud security

For ten years, organisations implementing cloud service security have relied on a document written in a different technological era. ISO/IEC 27017:2015 was developed before containers, orchestration and serverless architecture became standard in system design. Published in July 2026, the second edition of the standard – ISO/IEC 27017 – aims to rectify this by aligning cloud security guidelines with the updated base standard, ISO/IEC 27002:2022.

Key facts at a glance

Before we get into the details, here are a few things worth knowing, even if this is the first time you’ve heard of the standard:

• ISO/IEC 27017 is a code of practice for information security in cloud services[ (not a certification requirement in itself), developed jointly by the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (IEC).
• The first edition of the standard was published in 2015 and remained the sole point of reference in this field for over a decade.
• The second edition, ISO/IEC 27017:2026, was officially published on 27 July 2026 and supersedes the 2015 version.
• The standard covers both parties in a cloud relationship: the CSP (Cloud Service Provider) and the CSC (Cloud Service Customer).
• The base standard on which ISO/IEC 27017 is based is ISO/IEC 27002 – a general framework for information security. Its current version dates from 2022, hence the need to update the cloud standard as well.

Why the revision was inevitable

The first edition of the standard based its security measures on the structure of ISO/IEC 27002:2013 – a document which underwent a thorough overhaul in 2022: the 114 security controls, previously divided into 14 thematic categories, were consolidated into a set of 93 controls grouped into just four areas (organisational, human, physical and technological). The cloud standard had to follow the same path so that both documents could be applied in parallel, without having to reorder numbering or manage cross-references between two different organisational logics.

New document structure

The second edition moves away from a complex, multi-level classification in favour of a simpler security taxonomy, consistent with the rest of the 27000 family of standards. Each control has also been assigned attributes to facilitate the filtering and mapping of requirements – a solution that has already proven its worth in ISO/IEC 27002:2022 and enables security teams to find controls relevant to a specific risk more quickly, rather than having to search through the entire document line by line.

Fewer dedicated cloud controls, but no less protection

The most noticeable numerical change is the reduction in the number of controls prefixed with ‘CLD’, reserved exclusively for cloud environments – from seven to four. However, this does not mean a reduction in the scope of protection. A significant portion of the previous CLD guidelines has simply been incorporated and expanded upon in the updated version of ISO/IEC 27002:2022, which has itself become more universal and better addresses issues specific to distributed environments. The cloud standard now focuses on what genuinely requires separate treatment – the rest is already ‘built into’ the core security framework, although the model of shared responsibility between the provider and the customer remains the foundation upon which the entire standard is based.

Areas previously omitted

The second edition also introduces entirely new topics that were not included in the 2015 version:

• The role of cloud intermediaries – cloud brokers, integrators and independent security auditors are now standard participants in the cloud services supply chain, yet the previous edition of the standard did not take them into account at all. The new guidelines clarify the responsibilities of these entities towards both the provider and the customer.
• Shadow IT – detecting and limiting the unauthorised use of cloud services by employees has become a separate area of control, reflecting the scale of the problem in organisations where non-IT departments independently deploy SaaS tools without the knowledge of the security team.

Guidelines caught up by technology

The standard has also been expanded to include concepts that were virtually unknown in common use a decade ago: container orchestration and serverless architecture. This is a significant change, as the previous guidelines from 2015 were largely based on the model of traditional virtual machines – a model that is now increasingly out of step with the way companies actually build their cloud environments.

What this means for cloud providers and customers

The standard continues to cover both sides of the cloud relationship – cloud service providers (CSPs) and their customers (CSCs)– and still does not function as a standalone standard, but rather as an extension of the information security management system based on ISO/IEC 27001. For organisations that take cloud security seriously, however, the second edition sends a clear signal: it is worth checking whether existing procedures keep pace with the actual architecture of the services used today, rather than that of a decade ago.