The ISO 27017 2026 controls come from ISO/IEC 27017:2026, the second edition of the cloud security standard, published on 27 July 2026. It replaces the 2015 edition, follows the structure of ISO/IEC 27002:2022, and brings four cloud-specific controls for cloud service providers and cloud customers. If you sell, run or buy cloud services, it changes how you describe and prove your security.
The short version:
- The 2015 edition is withdrawn. The 2026 edition is the current one.
- The seven cloud controls of 2015 are now four: 5.38, 5.39, 8.35 and 8.36.
- ISO 27017 is guidance, so most companies show it through their ISO 27001 system rather than a separate certificate.
- Transition timing is set by certification bodies, so ask yours before you plan.
What Is ISO 27017?
ISO/IEC 27017 gives guidance on information security controls for cloud services. It builds on ISO/IEC 27002, the general catalogue of security controls, by adding cloud advice and a few cloud-specific controls.
It speaks to two roles. The cloud service provider (CSP) delivers the service. The cloud service customer (CSC) uses it. The standard covers public, private and hybrid cloud, including setups that combine several providers.
ISO 27017 does not replace ISO 27001 or ISO 27002. This table shows where each standard fits:
| Standard | What it does |
|---|---|
| ISO 27001:2022 | Sets the requirements for an information security management system (ISMS). This is what companies get certified to. |
| ISO 27002:2022 | Gives guidance on 93 security controls, grouped into four themes: organisational, people, physical and technological. |
| ISO 27017:2026 | Adds cloud-specific guidance and controls on top of ISO 27002. |
| ISO 27018:2025 | Covers protecting personal data in public cloud when the provider acts as a PII processor. |
What Changed in the ISO 27017 2026 Controls?
The biggest change is the foundation. ISO 27017:2026 is rebuilt on ISO 27002:2022, and the seven cloud controls of 2015 are now four. The 2015 edition was withdrawn on the day the new one was published.
| ISO 27017:2015 | ISO 27017:2026 | |
|---|---|---|
| Status | Withdrawn on 27 July 2026 | Current edition, published 27 July 2026 |
| Built on | The 2013 ISO 27002 structure (114 controls in 14 categories) | ISO 27002:2022 (93 controls in four themes) |
| Cloud-specific controls | Seven “CLD” controls in an annex | Four controls in the main text: 5.38, 5.39, 8.35 and 8.36 |
| Approach | Cloud guidance written for the older structure | Cloud advice added only where a control needs it, with references back to ISO 27002:2022 |
| New ground | Focused on the customer and provider relationship | Adds cloud service partners and the detection of unauthorised cloud use |
| Annexes | Cloud controls annex | Annex A maps the new controls to the 2015 edition. Annex B covers monitoring of cloud services. |
The new edition also reflects how cloud is built today, including containers and serverless setups, and it covers organisations that use several cloud providers at once.
What this means for you: if your policies, Statement of Applicability (SoA) or supplier questionnaires cite the 2015 numbering, such as CLD.6.3.1, they need remapping.
ISO 27017 2026 Controls: The Four Cloud-Specific Controls
Four controls sit in the standard itself. Two carry forward ideas from 2015, and two cover new ground. The table shows what each asks for and what a provider and a customer should be able to show an auditor.
| Control | What it asks | A provider should show | A customer should show |
|---|---|---|---|
| 5.38 Shared roles and responsibilities within a cloud computing environment | Agree who does what, for example patching, backups and incident response | A written responsibility split in the service agreement | A list of what you own and configure, matched to the contract |
| 5.39 Agreement on the roles and responsibilities of the cloud service partner (new) | Cover the third parties the provider relies on, not just the first provider in the chain | A list of partners and subprocessors with agreed roles | A supplier review that asks who else touches your data |
| 8.35 Segregation in virtual computing environments | Keep customer environments separate on shared infrastructure | Evidence of tenant separation, such as architecture notes and test results | A review of the provider’s assurance, such as an ISO 27001 certificate or SOC 2 report |
| 8.36 Detection and prevention of unauthorised use of cloud services (new) | Find and stop cloud use nobody approved, such as shadow SaaS accounts | Monitoring that detects misuse of your own platform | An inventory of cloud services in use, an approval process and login or spend monitoring |
Beyond these four, the ISO 27017 2026 controls add cloud guidance to many existing ISO 27002:2022 controls, split into advice for providers and for customers. That extra guidance is advice, not a new obligation. Choose your controls through your risk assessment, as you would for any ISO 27002 control.
Who Needs to Act on ISO 27017:2026?
Cloud service providers (SaaS, PaaS, IaaS and managed hosting companies) are asked first. Enterprise buyers will want to know which edition you follow. When this guide was checked in August 2026, even the public pages of the largest cloud providers still described the 2015 edition, so being clear about the 2026 edition can set you apart.
Cloud customers stay responsible for their own configuration. A provider’s certificate covers the provider’s certified scope only. It does not make you certified, and it does not replace your own controls.
Indian SaaS, IT and BPO companies that sell to global or enterprise buyers should expect security questionnaires that name ISO 27017. A clear shared responsibility matrix and an up-to-date mapping to the 2026 controls shorten those reviews.
Companies that are both a cloud customer and a provider, which is common in SaaS, need to apply the controls in both directions.
How to Prepare for ISO 27017:2026 in 12 Weeks
Most teams can finish the first pass in about 12 weeks. Adjust the pace to your size and your next audit date.
- Weeks 1-2: confirm your base. Check that your ISMS is on ISO 27001:2022. ISO 27017 sits on top of it.
- Weeks 1-2: find old references. List every document that cites the 2015 numbering, including your SoA, policies, supplier questionnaires, contracts and customer-facing security pages.
- Weeks 2-4: run a gap analysis. Compare your practices with the four cloud controls and with the cloud guidance on the ISO 27002 controls you have selected.
- Weeks 3-6: write the shared responsibility matrix. State who handles patching, backups, logging, access and incident response, and put the same split into your contracts.
- Weeks 4-8: map your cloud partners. List the subprocessors and partners behind each service, and check what your agreements say about their roles.
- Weeks 6-10: control unapproved cloud use. Build an inventory of the cloud services in use and a simple way to spot new ones.
- Weeks 8-12: update and train. Update the SoA, risk treatment plan and policies, train your cloud, security and support teams, and ask your certification body how and when it audits the 2026 edition.
Can You Get Certified to ISO 27017:2026?
ISO 27017 is a code of practice, not a management system standard like ISO 27001. In practice, companies show it through their ISO 27001 ISMS. You include the cloud controls in your Statement of Applicability and scope, and your auditor checks them during the ISO 27001 audit. For most organisations, ISO 27001 is effectively a prerequisite.
Certification bodies handle this differently. Ask yours:
- How is ISO 27017 shown on my certificate, if at all?
- When will you audit against the 2026 edition?
- What do I need to change in my SoA and scope?
Two cautions before you rely on someone else’s certificate. First, a provider’s assurance covers only its own certified scope, so check the edition, the in-scope services and regions, and the validity dates. Second, a provider’s certificate never replaces the controls you must run on your side.
Related Standards to Consider
ISO 27017 works best as part of a wider security and privacy set:
- ISO 27001 certification in India: the management system that ISO 27017 builds on.
- ISO 27018 certification in India: protecting personal data in public cloud, updated in 2025.
- ISO 27701 certification in India: a privacy information management system for personal data.
- SOC 2 compliance: the assurance report many global SaaS buyers also ask for.
ISO 27017:2026 FAQs
What is the current version of ISO 27017?
The current version is ISO/IEC 27017:2026, the second edition, published on 27 July 2026. It replaces ISO/IEC 27017:2015, which has been withdrawn.
How many cloud-specific controls are in ISO 27017:2026?
The ISO 27017 2026 controls number four: 5.38, 5.39, 8.35 and 8.36. The 2015 edition had seven. The 2026 edition also adds cloud guidance to many existing ISO 27002:2022 controls.
Is ISO 27017 mandatory?
No. It is guidance. You choose controls based on your risks and on legal, regulatory and contractual needs. Buyers and enterprise customers may still ask for it.
Can I get an ISO 27017 certificate?
Most companies show ISO 27017 through an ISO 27001 certified ISMS, with the cloud controls in their scope and SoA. How it appears on a certificate depends on the certification body, so ask yours.
Does my cloud provider’s ISO 27017 certificate cover me?
No. It covers the provider’s own certified scope. You still need to run and evidence the controls on your side, such as access, configuration and monitoring.
What is the difference between ISO 27017 and ISO 27018?
ISO 27017 gives general cloud security guidance. ISO 27018 is narrower and covers protecting personal data in public cloud when the provider acts as a PII processor.
Do I need to act now if I am already ISO 27001 certified?
Yes, start now, but calmly. Remap your documents and review your cloud contracts before your next surveillance audit, and confirm timing with your certification body.
Get Help With ISO 27017:2026
Not sure how the ISO 27017 2026 controls affect your company? Our consultants can review your ISMS, update your SoA and build a shared responsibility matrix your customers will trust. Talk to our ISO 27017 team or request a callback.