SO/IEC 27017:2026: What the New Cloud Security Guidance Means for Organizations Using ISO 27001 | Jay Wiessner
ISO/IEC 27017:2026: What the New Cloud Security Guidance Means for Organizations Using ISO 27001
Organizations that rely on cloud services need clear security responsibilities, appropriate safeguards, and a reliable way to assess risk. Published in July 2026, ISO/IEC 27017:2026 provides updated guidance for implementing information security controls in cloud environments. It builds on ISO/IEC 27002:2022 and is relevant to both cloud service providers and cloud service customers. For organizations already using ISO 27001, the guidance offers a practical way to examine cloud-specific risks within an existing information security management system (ISMS).
The key question is how the 2026 edition can inform your existing security practices without creating unnecessary work or confusion about certification requirements.
Key Takeaways
ISO/IEC 27017:2026 provides cloud-specific security guidance that can complement an ISO 27001 information security management system.
The 2026 edition replaces the 2015 edition and is based on ISO/IEC 27002:2022.
It addresses cloud security controls for both cloud service customers and cloud service providers.
The guidance helps clarify security responsibilities shared between providers and customers.
Organizations can review cloud-related risks and existing controls without assuming the standard creates new ISO 27001 certification requirements.
What Is ISO/IEC 27017:2026?
ISO/IEC 27017:2026 provides guidance for applying information security controls to cloud services. Based on ISO/IEC 27002:2022, it offers additional implementation guidance for relevant controls as well as controls and guidance that specifically address cloud security. It is intended for both cloud service customers and cloud service providers.
The standard applies to public, private, and hybrid cloud deployments. Cloud security can be complicated because infrastructure, applications, data, and operational responsibilities may be divided among different parties. ISO/IEC 27017 helps organizations address those shared responsibilities and make more consistent decisions about cloud-specific safeguards.
The controls and guidance should be considered in light of each organization's risk assessment and relevant legal, regulatory, and contractual obligations. ISO/IEC 27017 complements an information security management system; it does not replace ISO 27001.
What Changed in the 2026 Edition of ISO/IEC 27017?
The second edition, ISO/IEC 27017:2026, was published July 2026, replacing the 2015 edition. The current version explicitly draws on ISO/IEC 27002:2022, providing a contemporary foundation for guidance on the provision and use of cloud services.
For organizations, the practical priority is to evaluate what the current guidance means for their particular cloud environments. Review existing security responsibilities, cloud-related risks, supplier agreements, and implemented controls. Specific claims about controls newly added or revised between the two editions should be checked against the standards themselves.
The updated edition continues to address security for both cloud customers and providers. Its alignment with ISO/IEC 27002:2022 gives organizations a basis for reviewing cloud security practices within their broader information security management approach, including governance, supplier oversight, and risk treatment.
Publication of ISO/IEC 27017:2026 does not, by itself, create a new requirement for organizations to obtain or transition their ISO 27001 certification. Whether particular guidance or controls should be applied depends on the organization's risks and any applicable legal, regulatory, or contractual requirements.
How ISO/IEC 27017:2026 Relates to ISO 27001 and ISO 27002
ISO/IEC 27001 establishes requirements for an information security management system. ISO/IEC 27002 provides guidance on information security controls. ISO/IEC 27017 adds implementation guidance and controls that are specifically relevant to cloud services. Together, these publications can support a risk-based approach to cloud security.
Organizations using ISO/IEC 27001:2022 can consider ISO/IEC 27017:2026 when selecting, implementing, and reviewing cloud-related security controls. Its guidance supports the ISMS, but it does not automatically add new ISO 27001 certification requirements.
For example, organizations can use the guidance to clarify who manages access, monitors security events, responds to incidents, and protects information in a cloud service arrangement. Clearer responsibilities and documented decisions can strengthen both security governance and supplier relationships.
A useful way to apply this relationship is through the organization’s existing risk-treatment process. For each cloud service, identify the information it handles, the business impact of losing confidentiality, integrity, or availability, and the controls already in place. Record why additional safeguards are—or are not—appropriate. This creates an auditable rationale for security decisions without treating ISO/IEC 27017 as a separate checklist that must be completed in full.
Cloud Security Responsibilities for Providers and Customers
Cloud security is often a shared responsibility. ISO/IEC 27017:2026 provides guidance that can help cloud service providers and their customers understand how security roles and controls apply within their respective environments.
The division of responsibility depends on the cloud service model and the terms of the service agreement. A provider may manage underlying infrastructure, while a customer may remain responsible for user access, data classification, configuration, or application security. Those responsibilities should be explicitly identified rather than assumed.
Clear agreements about access controls, incident response, monitoring, data protection, and provider oversight reduce the risk of gaps between what a customer expects and what a provider actually delivers. Organizations should also revisit these arrangements as cloud services or business needs change.
Consider a company using a cloud-hosted customer database. The provider may secure the underlying hosting infrastructure, while the customer determines which employees can view records and how access is removed when an employee leaves. The organization should verify these divisions of responsibility in the service documentation rather than relying on assumptions. A simple responsibility matrix identifying the activity, owner, supporting evidence, and review date can help prevent important tasks from falling between the parties.
Key Cloud Security Practices Organizations Should Review
Organizations using cloud services can review their existing controls with reference to ISO/IEC 27017:2026. This is a risk-based assessment, not an assumption that every control in the document is mandatory for ISO 27001 certification.
Key areas to consider include identity and access management, authentication, encryption, data protection, configuration management, and supplier relationships. The appropriate safeguards depend on the nature of the services used, the sensitivity of information, and the allocation of responsibility between the customer and provider.
Incident response plans should be designed to address cloud-specific scenarios and threats. By incorporating cloud-specific elements into their response strategies, organizations can effectively manage incidents and minimize potential damage. Continuous monitoring and auditing practices are also essential to maintaining a robust cloud security posture.
When reviewing controls, look beyond whether a policy exists. Ask whether administrator accounts use appropriate authentication, whether access is periodically reviewed, and whether configurations follow an approved baseline. For sensitive cloud data, determine who manages encryption settings and keys, how backups are protected, and how the organization can retrieve or delete its information when a contract ends. Test whether incident escalation contacts and notification expectations are understood by both parties. The answers should reflect the organization’s risks and actual service arrangements, not a generic control list.
Practical Steps for Organizations Using ISO 27001
If your organization already maintains an ISO 27001 ISMS, begin with a focused review of cloud-related risks, the services you use, and the controls already in place. A gap assessment can help identify where the 2026 guidance is relevant and where existing practices may need to be clarified or strengthened.
Next, review cloud service contracts, assigned security responsibilities, access management, monitoring, and incident response arrangements. Incorporate any justified improvements into your established risk treatment and policy review processes. Provide staff guidance or training where roles and procedures have changed.
Document decisions about applicable cloud controls and assign owners to any improvements. Working with cloud service providers can help resolve uncertainty about shared responsibilities. Reassess the arrangement when services, risks, contracts, or business requirements change.
A manageable improvement plan can start with the highest-risk or most business-critical cloud services rather than attempting to review every system at once. Prioritize findings according to potential impact and likelihood, assign an accountable owner, and set a review date. Preserve evidence such as service agreements, configuration records, assessment results, and approval decisions in the same documentation process used for the existing ISMS. Revisit the plan when a provider changes its service, the organization adopts new cloud tools, or material business requirements shift.
How My ISO Consultants Can Help
Organizations managing an ISO 27001 information security program may benefit from an outside perspective when reviewing cloud-related risks and controls. My ISO Consultants can be a resource for discussing practical information security management priorities and identifying where further assessment may be useful.
A useful starting point is to review the organization's cloud service inventory, security responsibilities, risk assessment, and supplier oversight practices. The objective is to make informed decisions about applying relevant guidance rather than treating every recommendation as a mandatory certification requirement.
If your organization wants to evaluate how ISO/IEC 27017:2026 relates to its existing ISO 27001 practices, contact My ISO Consultants to discuss your goals and the appropriate next steps.
ISO/IEC 27017:2026 gives cloud service providers and customers updated guidance based on ISO/IEC 27002:2022. For organizations using ISO 27001, it can inform practical reviews of cloud risks, shared responsibilities, and existing security controls. Applying the guidance in proportion to your organization's needs can support a more consistent approach to cloud security.
To discuss cloud security within your ISO 27001 program, contact My ISO Consultants.
Frequently Asked Questions:
Does ISO/IEC 27017:2026 change ISO 27001 certification requirements?
No. Publishing the 2026 edition does not automatically change ISO 27001 certification requirements or impose a new transition deadline. An organization should determine which cloud security guidance is relevant through its risk assessment and any legal, contractual, or other applicable obligations.
What is different about ISO/IEC 27017:2026 compared with the 2015 edition?
The 2026 edition replaces the 2015 version and is based on ISO/IEC 27002:2022. Organizations should compare the applicable provisions of both editions before stating that any individual control was added, removed, or revised. The immediate practical task is to assess whether current cloud practices remain suitable.
Who is responsible for security when an organization uses a cloud provider?
Responsibilities depend on the service model and agreement. A provider may handle the underlying platform, while the customer manages user permissions, data classification, and certain configurations. Documenting each party’s role makes security gaps easier to identify.
Should an ISO 27001-certified organization conduct a cloud security gap assessment?
A focused review can be useful where cloud services are important to the business or where responsibilities and controls are unclear. The organization can compare its current practices with relevant ISO/IEC 27017 guidance and prioritize gaps according to risk, instead of assuming every recommendation is mandatory.
Can ISO/IEC 27017 be used without replacing an existing ISMS?
Yes. ISO/IEC 27017 supplies cloud-focused control guidance that can be considered within an existing ISO 27001 information security management system. Risk assessment, control selection, ownership, monitoring, and continuous improvement can remain part of established ISMS processes.
Reference: ISO/IEC 27017:2026 — https://www.iso.org/standard/27017
Author: Jay Wiessner
