Overview
ISO/IEC 27017 is an international standard that provides guidelines for information security controls applicable to the provision and use of cloud services. Its purpose is to give both cloud service providers and cloud service customers additional, cloud-specific implementation guidance to address the particular risks and shared responsibilities inherent in cloud computing. The standard is a code of practice that builds directly upon ISO/IEC 27002, offering cloud-specific implementation advice for many of that standard's controls while also introducing a set of additional controls that are unique to the cloud context. Its scope applies to organizations of all sizes that provide or consume cloud services, and it is intended for cloud providers, customers, security architects, auditors and procurement and compliance teams seeking to clarify security responsibilities in cloud arrangements. Rather than functioning as a standalone certifiable management system, ISO/IEC 27017 is designed to be used alongside an ISO/IEC 27001 Information Security Management System, enriching the selection and implementation of Annex A controls with cloud-relevant guidance. It addresses matters such as the division of security responsibilities between provider and customer, removal and return of assets on contract termination, segregation within virtualized environments, administrator operational security, monitoring of cloud services and alignment of the virtual and physical network environment. It is frequently applied together with ISO/IEC 27018, which focuses on the protection of personally identifiable information in public clouds, and it complements the wider ISO/IEC 27000 family. The main benefits include clearer allocation of security responsibilities, reduced ambiguity in cloud contracts, stronger assurance for customers and more consistent security across cloud deployments. In certification terms, conformity is typically assessed as an extension to ISO/IEC 27001 certification, where the certification scope explicitly references the cloud controls, allowing providers to demonstrate credible, cloud-specific security assurance to customers and regulators.
Included: 76 ready-to-use, fully editable documents (manual, procedures, forms, records, checklists, guidance and training material).
License: single-organization license; delivered electronically as a ZIP archive.
From purchase to audit-ready
Buy & download instantly
Pay securely by card. Your ZIP download link appears immediately on the confirmation page and in your email.
Edit & brand as your own
Open the native Word & Excel files, add your logo and details, and adapt everything to your organisation.
Implement & get audit-ready
Roll out the manuals, procedures, forms and checklists to build a working, certification-ready system.
Frequently asked questions
What exactly do I receive?
A downloadable ZIP containing the full set of ready-to-use documents for this toolkit — manuals, procedures, forms, records, checklists, guidance and training material, all in editable Word and Excel format. The exact document count is shown at the top of this page.
Are the documents really editable?
Yes. Every file is native Microsoft Word or Excel — no locked PDFs. Add your logo, change wording, and tailor the content to your organisation. The toolkit is yours to keep and reuse.
Does this certify my organisation?
No. These are documentation toolkits aligned to the relevant standard to help you prepare. Certification itself is issued by an accredited certification body after their audit. Our toolkits give you a strong, audit-ready starting point.
How is it delivered?
Instantly and digitally. There's no physical shipment — you download the files right after payment and receive a backup link by email.
Do I get updates?
Yes. If we revise this toolkit, you're entitled to the updated version at no extra cost — just contact us with your order details.
What is your refund policy?
Because these are digital products delivered instantly, all sales are final once downloaded. If you have any issue with your files, contact us and we'll make it right. See our Refund Policy for full details.