ISO 27017

Overview

ISO/IEC 27017 provides guidelines for information security controls applicable to the provision and use of cloud services. It extends ISO 27002 with additional cloud-specific controls covering shared responsibility delineation, virtual machine hardening, cloud service administration, and tenant isolation. CodeMiners applies ISO 27017 controls to govern the security of all cloud service delivery.

Governing Body

International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC)

Scope of Certification

Covers both cloud service providers and cloud service customers. Addresses cloud-specific risks including multi-tenancy, virtualization, resource sharing, data segregation, and cloud administration.

Audit and Assessment Process

Assessed as part of the ISO 27001 certification cycle. Auditors evaluate cloud-specific control implementation, shared responsibility documentation, and cloud service security configurations.

Key Requirements

1. Shared responsibility documentation for each cloud service
2. Tenant isolation and data segregation controls
3. Virtual machine image hardening and lifecycle management
4. Cloud administrator access controls and monitoring
5. Customer data portability and removal on termination

Compliance Entitlements

• Cloud-specific security control implementation
• Clear shared responsibility model between provider and customer
• Virtual infrastructure and cloud administration security
• Complements ISO 27001 for cloud-native organizations

Client Benefits

• Provides structured assurance of cloud service security
• Clearly defines security responsibilities between CodeMiners and the client
• Reduces ambiguity in cloud security governance

Related Certifications