ISO/IEC 27017:2026 — Information Security Controls for Cloud Services
Certification of the information security controls an organisation applies to the cloud services it provides or uses, against ISO/IEC 27017:2026, the second edition of the international guidance on information security controls for cloud services, published in July 2026. A standalone certificate of conformity, not an extension of an ISO/IEC 27001 certificate. Issued By CAS under its own authority, outside the EGAC accredited scope, with no EGAC or IAF mark.
Standard
ISO/IEC 27017:2026
Service type
By CAS
Issued under
CAS — own authority
What it is
ISO/IEC 27017:2026 gives guidance on information security controls for providing and using cloud services. It builds on ISO/IEC 27002:2022: for the relevant ISO/IEC 27002 controls it adds implementation guidance specific to cloud services, and it adds controls of its own that apply only to cloud services, for example on shared roles and responsibilities in a cloud computing environment and on segregation in virtual computing environments. The guidance is given for both the cloud service customer and the cloud service provider, and it applies to all cloud deployment models, including private cloud. This second edition, published in July 2026, replaces ISO/IEC 27017:2015 and is based on the 2022 edition of ISO/IEC 27002.
Who needs it
Cloud service providers — for example software-as-a-service, platform and infrastructure providers, hosting and data-centre operators and managed service providers — and organisations that use cloud services and want independent evidence of how they secure them, for example to answer customer security questionnaires or procurement requirements.
Audit process
ISO/IEC 27017 is a guidance document: it gives guidance on controls and their implementation, not requirements for a management system. CAS audits the information security controls the organisation applies to the cloud services within the scope stated on the certificate — as cloud service provider, as cloud service customer, or both — against assessment criteria drawn from the document's controls and implementation guidance. Certification follows a two-stage initial audit (Stage 1 and Stage 2) under ISO/IEC 17021-1:2015, with annual surveillance audits and recertification every three years. The certificate is a Certificate of Conformity issued By CAS, outside CAS's EGAC accreditation, and can be verified on CAS CertSearch.
Frequently asked questions
Common questions
Is ISO/IEC 27017 certification by CAS accredited?
No. CAS issues ISO/IEC 27017 certificates By CAS, under its own authority and outside its EGAC accreditation, which covers ISO 9001, 14001, 45001, 22000, 50001 and 22301 only. The certificate carries the CAS mark, not the EGAC or IAF marks, and can be verified on CAS CertSearch.
Do we need ISO/IEC 27001 certification first?
No. ISO/IEC 27001 sets requirements for an information security management system; ISO/IEC 27017 gives guidance on information security controls for cloud services, built on ISO/IEC 27002. CAS issues the ISO/IEC 27017 certificate as a standalone Certificate of Conformity, not as an extension of an ISO/IEC 27001 certificate. An organisation may hold both, and the two can be audited together.
Is it for cloud service providers or cloud service customers?
Both. The document gives guidance for the cloud service customer and for the cloud service provider. The scope on the certificate states which cloud services were audited and in which role — provider, customer or both.
Ready to certify against ISO/IEC 27017:2026?
Tell us about your organisation and scope — we’ll come back with a costed proposal, usually within two business days. No obligation.