Does it apply if the infrastructure is ours?

Yes. The controls govern how we design and administer cloud environments, whether they sit under our account or yours. In the latter case we agree with you which responsibilities remain with your organization.

Are you tied to a specific cloud provider?

No. The standard is about controls, not providers: the same practices apply regardless of the platform a project is hosted on.

Certifications

ISO/IEC 27017

The ISO/IEC 27001 extension dedicated to cloud services: it adds controls specific to designing, administering and consuming cloud infrastructure.

Tell us about your project

What it is

ISO/IEC 27017 is a code of practice that supplements the ISO/IEC 27001 controls with cloud-specific guidance. It clarifies how responsibilities are split between service provider and customer, and addresses the issues that behave differently in the cloud: separation of virtual environments, administrative account management, data removal at end of service, and resource monitoring.

What it means for you

Projects we host or operate on cloud infrastructure follow controls designed for that context: limited, explicitly assigned administrative roles, isolation between different projects' environments, configuration managed as code and therefore auditable, and clear rules for what happens to data when a service is decommissioned.

How we maintain it

We keep infrastructure configuration under version control, so every change is tracked and repeatable. We review privileged accounts periodically, monitor running resources, and document the split of responsibilities with the cloud providers we use.

Frequently asked questions

Certificate details, the certification body and the exact scope of certification are available on request: get in touch and we'll send you the current documentation.

ISO/IEC 27001 defines the security management system as a whole. ISO/IEC 27017 does not replace it: it adds controls specific to the cloud, where responsibility is shared between provider and customer and some risks take a different form.

Other certifications

ISO/IEC 27001

The international standard for information security management systems: it defines how an organization identifies risks to its data and applies documented controls to reduce them.

ISO 9001

The international standard for quality management systems: it defines how an organization keeps its processes under control to produce repeatable results and improve them over time.

ISO/IEC 27018

The ISO/IEC 27001 extension dedicated to personal data handled in public cloud: it defines how information relating to identifiable people must be protected.

Ready to kick off the digital transformation of your business?

Talk directly with our technical lead.

Book a free call Or send us a message