Governance, Risk & Compliance
ISO 27017 cloud security certification exists to close a specific gap. ISO 27001:2022 tells you to manage supplier risk and control access; it does not tell you who is responsible for hypervisor hardening, what happens to your data when you terminate a cloud contract, or how a customer and a provider divide the work of monitoring.
ISO 27017 is a code of practice that extends ISO 27002 with cloud-specific guidance: additional implementation advice on existing controls plus seven controls that exist only in the cloud context. Crucially, it is written for both sides: cloud service customers and cloud service providers each get their own guidance, and the point of the standard is making the boundary between them explicit.
It is not a standalone certification. It is audited as an extension of an ISO 27001:2022 management system, so the sensible route is to build or extend the ISMS with cloud scope from the start. Where personal data is involved, ISO 27018 is the companion standard; the technical half is cloud security testing.
Why you need it
01 / 06Both parties assume the other handles logging, key management, backup or vulnerability scanning for a given layer. ISO 27017 requires the split to be documented control by control, which is the single most useful thing it produces.
Virtual machine hardening, administrative operations in a shared environment, segregation between tenants, and alignment of customer and provider virtual networks are cloud-specific concerns that ISO 27002 addresses only in general terms.
For a SaaS or cloud-hosted product, "we are ISO 27001 certified" increasingly draws the follow-up question of what that covers in the cloud. ISO 27017 answers it with a recognised scope rather than a bespoke explanation.
The standard requires attention to asset return and removal on contract termination: what happens to your data, in what format, on what timeline, and with what proof of deletion. Most cloud contracts are signed without anyone asking.
Instrument
02 / 06ISO 27017 sits on top of an ISO 27001:2022 management system. Toggle what you are asked for; the overlap is work you only do once.
What we deliver
03 / 06Your current cloud controls measured against ISO 27017 guidance and the seven cloud-specific controls, across every provider and service model you use. Delivered as a gap register with the shared-responsibility position stated for each item.
Which cloud services, environments, regions and data are covered, and whether you are being assessed as a cloud service customer, a provider, or, as is increasingly common, both, because you consume infrastructure and sell a service built on it.
A control-by-control matrix of what your provider does, what you do, and what neither of you currently does. The third column is the deliverable; it is almost never empty, and it is what an auditor will look for.
Virtual machine and image hardening, tenant segregation, encryption and key management with clear ownership, administrative operations control, cloud monitoring aligned between customer and provider, and the asset return and removal process for contract exit.
Policies and procedures written for cloud operations rather than adapted from a data-centre template: provider selection and assessment, configuration standards, change management in infrastructure-as-code, and multi-cloud governance.
Role-specific training for the engineers who operate the environment and the people who will be interviewed, then internal audit against the extended scope and support through the certification body's assessment.
How we run it
04 / 06Current controls against ISO 27017, per provider and per service model, with evidence sampled from the environment rather than from documentation. Existing ISO 27001:2022 coverage is credited so the gap is genuinely incremental.
Weeks 1-3Services, environments and data in scope, and your role in each relationship. This decides which half of the standard's guidance applies to you and how the certificate will read.
Weeks 3-4The seven cloud controls and the cloud-extended guidance on existing ones (segregation, hardening, administrative operations, monitoring alignment, key management and asset return) implemented in the live environment.
Months 1-4The policy and procedure set, integrated into the existing ISMS documentation rather than maintained separately, so that one management system covers both.
Months 2-4Cloud responsibilities made concrete for the people who hold them, and audit rehearsal for those who will be interviewed. Auditors ask engineers directly what they are responsible for.
Month 4Internal audit against the extended scope, corrective action, and the certification body's assessment of ISO 27017 alongside your ISO 27001:2022 audit.
Months 5-7Key benefits
05 / 06A control-by-control matrix showing who does what between you and each provider, which resolves the gaps that both parties currently assume the other covers.
A recognised standard covering the cloud half of your estate, so customer reviews stop turning into architecture conversations.
Data return and deletion terms, formats and timelines established while you still have a working relationship with the provider.
Tools we use
06 / 06No “latest tech tools”. These are the ones your report will cite, alongside the manual work that a tool cannot do for you.
Standards
Cloud posture evidence
Provider assurance
Control operation
Validation
Why Aphelion
SharedDarshap Nayak, formerly of KPMG, holds a master’s degree in cybersecurity and more than seven years in security operations. Jaimin Somani brings fifteen-plus years of academic and hands-on VAPT. Hemang Desai is an ICT network specialist from Australia. You will meet them, not a logo.
Meet the teamEvery finding arrives with the reproduction steps, the affected asset and the fix, ranked by what it actually reaches in your environment, not by a CVSS number copied from a scanner. You get the report and the raw output, not a summary of a summary.
See how we testAhmedabad and Sharjah, working the same methodology on the same tooling. Indian data-residency requirements and UAE delivery are both ordinary here, and the AphelioNYX AD Pen-Test module runs entirely inside your perimeter when regulation says it must.
The platformInvent a statistic to make a slide land. Publish your name as a client without written permission. Print an award badge nobody awarded. Founded in 2024. We say so, and we attribute experience to the people who have it.
Ask us anythingAcross the globe, and across eight industries. We name a client only with their written permission.
AphelioNYX is SOC 2, ISO and GDPR compliant; attestations are available on request under NDA. We would rather hand you the report than print a badge.
Questions
FAQNext door
RelatedA personalised walkthrough and a free readiness assessment against the frameworks you are actually being asked for. Pick a time that suits you, or write to us. We reply within one business day.