ISO 27017:2026: What Businesses Need to Know About the New Cloud Security Standard

Cloud computing has become a core part of modern business operations. Organisations now rely on cloud platforms to store information, run applications, support remote work, process customer data and deliver digital services.

But moving systems to the cloud also creates security challenges.

Who is responsible for protecting the data? How should access be managed? What happens when security responsibilities are shared between a cloud provider and its customer?

The newly published ISO 27017:2026 provides updated cloud-specific security guidance to help organisations address these challenges.

Published in July 2026, ISO/IEC 27017:2026 is the second edition of the standard and replaces ISO/IEC 27017:2015. It builds on ISO/IEC 27002 and provides additional guidance and controls relevant to cloud services.

For businesses using or providing cloud services, understanding the new edition is becoming increasingly important.

What Is ISO 27017:2026?

ISO/IEC 27017:2026 is an international standard that provides guidance for implementing information security controls in cloud services.

It builds on ISO/IEC 27002 and adds cloud-specific guidance and additional controls for both:

• Cloud service providers (CSPs)
• Cloud service customers (CSCs)

The standard is designed to help organisations address security risks created by the shared nature of cloud computing.

This is important because cloud security responsibilities are not always held by one organisation.

For example, a business may own its data and applications while a cloud provider manages the underlying infrastructure. Both parties may have different security responsibilities.

ISO 27017 helps bring greater clarity to these responsibilities.

Read the official ISO 27017:2026 standard information

Why Is ISO 27017:2026 Important for Cloud Security?

Traditional information security controls do not always address the practical challenges of cloud environments.

Cloud services introduce additional considerations around:

• Shared infrastructure
• Virtual environments
• Cloud administration
• Customer and provider responsibilities
• Access to cloud resources
• Data protection
• Service availability
• Cloud-specific operational risks
• Third-party dependencies

For example, an organisation may assume that its cloud provider is responsible for a particular security control, while the provider may expect the customer to manage it.

This can create gaps.

ISO 27017 provides a common approach for addressing cloud-specific security responsibilities and controls. According to ISO, the standard can support clearer responsibilities, more consistent implementation of cloud security controls and better management of contractual, legal and regulatory requirements.

What Has Changed in ISO 27017:2026?

One of the most important developments is that ISO 27017:2026 replaces the previous 2015 edition.

ISO lists ISO/IEC 27017:2015 as withdrawn and ISO/IEC 27017:2026 as the current published edition.

The new edition continues the cloud-security focus of the standard while updating it within the current ISO/IEC 27002 framework.

Organisations should therefore avoid treating the 2026 edition simply as an old checklist with a new publication date.

The updated standard should be considered in the context of the organisation’s current cloud architecture, risks, contracts, responsibilities and information security management system.

How Does ISO 27017:2026 Relate to ISO 27001?

ISO 27017 and ISO 27001 are closely connected, but they serve different purposes.

ISO/IEC 27001:2022 specifies requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS).

ISO 27017 provides additional cloud-specific guidance and controls that can complement an organisation’s broader information security approach.

A simple way to understand the relationship is:

ISO 27001 → Overall information security management

ISO 27017 → Cloud-specific security guidance and controls

For organisations operating cloud environments, using the two together can help connect broader information-security governance with cloud-specific risks.

Learn more about ISO/IEC 27001

Who Should Use ISO 27017:2026?

ISO 27017:2026 is relevant to organisations that provide or use cloud services.

This can include:

• Cloud service providers
• Software-as-a-Service providers
• IT service providers
• Data hosting companies
• Technology companies
• Financial institutions
• Healthcare organisations
• E-commerce businesses
• SaaS companies
• Government and public-sector organisations
• Organisations migrating workloads to cloud platforms

The standard applies across public, private and hybrid cloud environments.

Key Cloud Security Areas Covered by ISO 27017:2026

ISO 27017 focuses on cloud-specific implementation of information security controls.

Some important areas organisations should consider include the following.

1. Shared Security Responsibilities

Cloud security is often a shared responsibility.

The cloud provider and customer may each control different parts of the environment.

For example:

• The provider may manage physical infrastructure.
• The customer may manage user access.
• The provider may manage certain platform-level controls.
• The customer may remain responsible for its data and configurations.

Clearly defining these responsibilities can reduce security gaps.

2. Cloud Access Control

Cloud environments can involve employees, administrators, applications, service accounts and automated workloads.

Organisations therefore need appropriate controls around:

• Authentication
• Authorisation
• Privileged access
• User permissions
• Administrative access
• Access reviews

Access should be aligned with business requirements and security risks.

3. Protection of Cloud Data

Cloud environments may contain highly sensitive information, including:

• Customer information
• Financial data
• Intellectual property
• Employee information
• Business records
• Personal data

Organisations need to understand where information is stored, who can access it and how it is protected throughout its lifecycle.

For organisations processing personal information in public cloud environments, ISO/IEC 27018:2025 provides additional guidance specifically focused on protecting PII when a cloud service provider acts as a PII processor.

4. Cloud Configuration and Operations

Misconfigured cloud environments can create significant security exposure.

Security teams should consider:

• Configuration management
• Administrative privileges
• Network controls
• Storage permissions
• Logging and monitoring
• Vulnerability management
• Security updates

Cloud security should be treated as an ongoing management activity rather than a one-time implementation task.

5. Incident Management

Cloud incidents can involve multiple parties.

An organisation may need to coordinate with its cloud provider when responding to:

• Data breaches
• Unauthorised access
• Service disruption
• Malware incidents
• Account compromise
• Data loss

Clear incident responsibilities and communication channels can help organisations respond more effectively.

What Are the Benefits of ISO 27017:2026?

Implementing cloud-specific security controls can provide several benefits.

Stronger cloud security

Organisations can address risks that are specific to cloud services rather than relying only on general information security controls.

Clearer responsibilities

The standard helps organisations clarify security responsibilities between cloud customers and providers.

Better risk management

Cloud-specific risks can be incorporated into the organisation’s broader information security risk-management approach.

Improved customer confidence

Demonstrating a structured approach to cloud security can help strengthen trust among customers, partners and stakeholders.

Better alignment with ISO 27001

ISO 27017 can complement an organisation’s existing ISO 27001-based information security management approach.

Improved cloud governance

Organisations can establish clearer expectations around cloud security controls, responsibilities and operational processes.

ISO itself identifies stronger information security, clearer responsibilities, more consistent cloud controls and improved trust and transparency as benefits associated with ISO/IEC 27017.

ISO 27017:2026 for Cloud Service Providers

Cloud service providers have a particularly important role because they operate infrastructure and services used by multiple customers.

A provider may need to consider how security responsibilities are communicated, implemented and monitored across its cloud services.

Important questions include:

• What security responsibilities belong to the provider?
• What responsibilities remain with the customer?
• How are responsibilities communicated?
• How are security incidents managed?
• How are customer environments protected?
• How are cloud security controls monitored?
• How are contractual and regulatory requirements addressed?

ISO 27017 provides guidance that can help cloud providers establish a more structured approach to these issues.

ISO 27017:2026 for Cloud Customers

Cloud customers also have important security responsibilities.

Moving data or applications to a cloud platform does not automatically transfer every security responsibility to the provider.

Organisations should understand:

• Which controls are managed by the cloud provider
• Which controls must be managed internally
• What data is stored in the cloud
• Who has access to the data
• What applications connect to the environment
• How security incidents are reported
• What contractual security requirements apply
• How the organisation can monitor cloud security

This is particularly important when organisations use multiple cloud providers.

ISO 27017 and the Shared Responsibility Model

The shared responsibility model is one of the most important concepts in cloud security.

Consider a company using a cloud-based business application.

The cloud provider may be responsible for certain infrastructure and platform controls. The customer may still be responsible for user accounts, permissions, data and configuration choices.

If either party misunderstands its responsibilities, a security gap can occur.

ISO 27017 can help organisations establish greater clarity around cloud security responsibilities and controls.

How Can Organisations Prepare for ISO 27017:2026?

Organisations do not need to approach cloud security as a single large project.

A practical starting point is to review the existing cloud environment.

Step 1: Identify cloud services

Create an inventory of the cloud platforms, applications and services being used across the organisation.

Step 2: Identify critical information

Determine which data and business processes depend on cloud services.

Step 3: Map responsibilities

Document which security activities are managed by the organisation and which are managed by the cloud provider.

Step 4: Assess cloud-specific risks

Identify risks related to access, configuration, data protection, availability, suppliers and cloud operations.

Step 5: Review existing ISO 27001 controls

If the organisation already has an ISO 27001-based ISMS, assess how cloud-specific requirements and guidance can be incorporated.

Step 6: Review contracts and SLAs

Cloud contracts should clearly address relevant security responsibilities, incident notification, data protection and service requirements.

Step 7: Strengthen monitoring

Review logging, access monitoring, configuration monitoring and incident detection capabilities.

Step 8: Train relevant teams

IT, information security, cloud engineering, compliance and risk teams should understand their responsibilities in the cloud environment.

Is ISO 27017:2026 Relevant If an Organisation Already Has ISO 27001?

Yes, it can be.

ISO 27001 provides the broader requirements for an Information Security Management System, while ISO 27017 focuses specifically on cloud services.

For organisations with significant cloud dependencies, ISO 27017 can provide additional cloud-specific guidance that complements their information security management approach.

The two standards should therefore not be viewed as competing alternatives.

Instead, organisations can consider how cloud-specific controls and responsibilities fit within their wider information security risk-management framework.

ISO 27017:2026 and Cloud Security in India

Indian organisations are rapidly adopting cloud infrastructure, SaaS platforms and digital services.

This means cloud security is becoming relevant across sectors such as:

• Banking and financial services
• IT and ITES
• Healthcare
• Manufacturing
• E-commerce
• Telecommunications
• Professional services
• Government
• Education

For organisations operating in regulated or security-sensitive sectors, cloud security can also become an important customer, contractual and compliance consideration.

ISO 27017 provides a structured international reference for addressing security considerations specific to cloud services.

ISOQAR India’s ISO 27017 Cloud Security Services

ISOQAR India provides ISO 27017 Cloud Security Management services and positions ISO 27017 alongside ISO 27001 as part of its information and cloud security portfolio.

ISOQAR’s ISO 27017 service covers areas including cloud security risk assessment, cloud-specific controls, shared responsibilities, implementation, internal audits and certification-related audit stages.

Explore ISO 27017 Cloud Security Management with ISOQAR India

ISOQAR India also provides broader Digital Trust & Security Services, including ISO/IEC 27001, ISO/IEC 27701, AI management systems, cybersecurity assurance and cloud security assessment services.

Explore Digital Trust & Security Services

For organisations operating in the IT and ITES sector, ISOQAR also highlights ISO 27017 alongside ISO 27001, ISO 27018, ISO 20000 and ISO 22301 as relevant standards for managing information and cloud-related risks.

Explore ISO Certifications for IT & ITES

ISO 27017:2026 Training

Understanding the standard is important for professionals responsible for cloud security, information security and compliance.

ISOQAR India also lists ISO 27017 Cloud Security Management Training within its management systems training portfolio.

The training covers areas such as:

• ISO 27017 principles
• Cloud-specific security controls
• Integration with ISO 27001
• Shared responsibilities
• Cloud security risks
• Practical implementation
• Case studies and exercises

Explore ISO 27017 Cloud Security Training

ISO 27017:2026 vs ISO 27001: What Is the Difference?

ISO/IEC 27001:2022 specifies ISMS requirements, while ISO/IEC 27017:2026 provides cloud-specific guidance and controls based on ISO/IEC 27002.

Conclusion

Cloud adoption is changing how organisations manage information security.

As businesses increasingly depend on public, private and hybrid cloud environments, security responsibilities can become more complex. Cloud customers and providers need to understand who is responsible for which controls and how cloud-specific risks are managed.

ISO 27017:2026 provides an updated international reference for addressing these challenges.

The new edition, published in July 2026, builds on ISO/IEC 27002 and provides cloud-specific guidance and controls for both cloud service providers and customers.

For organisations already using ISO 27001, ISO 27017 can provide additional cloud-focused guidance. For cloud providers and businesses heavily dependent on cloud services, it can support clearer responsibilities, stronger controls and better cloud security governance.

If your organisation is reviewing its cloud security approach, ISOQAR India can help you explore ISO 27017 Cloud Security Management and related information-security services.

Talk to ISOQAR India About ISO 27017