ISO/IEC 27017 published: what changed and what certified organisations must do

The ISO/IEC 27017 revision has been published as edition 2 of the cloud services code of practice, dated 27 July 2026. For organisations that provide or use cloud services, it is now the current guidance for information security controls in the cloud, and it sits inside the ISO/IEC 27001 family.

What is ISO/IEC 27017 and what does this edition cover?

ISO/IEC 27017 carries the title Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for cloud services. It is a code of practice, which means it offers guidance rather than requirements, and edition 2 was prepared by ISO/IEC JTC 1/SC 27.

The document provides guidance for information security controls, based on ISO/IEC 27002, applicable to the provision and use of cloud services. It does this in two ways: it adds guidance for relevant controls already specified in ISO/IEC 27002:2022, and it adds controls with guidance that relate specifically to cloud services.

Its audience is both sides of a cloud relationship, since it provides controls and guidance for cloud service customers (CSCs) and cloud service providers (CSPs). It is also considered a horizontal document, because it offers a foundation and a common understanding of security regarding the provision and use of cloud services.

Who is affected by the ISO/IEC 27017 revision?

Because the document covers provision and use, it reaches organisations that buy cloud services and organisations that sell them. Many organisations sit on both sides at once, depending on the services in question, and the guidance is written for each role.

It matters most to organisations that are certified to ISO/IEC 27001 and whose scope includes cloud services. ISO/IEC 27017 is a code of practice, not a requirements standard, so organisations demonstrate its cloud controls within the scope of their ISO/IEC 27001 certification. The revision therefore changes the reference point against which those cloud controls are described, reviewed and evidenced.

What changes in edition 2 and what stays the same?

The table below sets out the position in edition 2, including the elements that carry over from how the document already works.

Aspect	Position
Edition	Edition 2, published 27 July 2026
Status	Code of practice (guidance), not a requirements standard
Basis for controls	ISO/IEC 27002:2022
Who it addresses	Cloud service customers (CSCs) and cloud service providers (CSPs)
Deployment models	All types of cloud deployment models, including the private cloud
Standard family	Part of the ISO/IEC 27001 family
Committee	ISO/IEC JTC 1/SC 27
Previous edition	ISO/IEC 27017:2015

What must certified organisations do now?

The steps below apply whether you act as a customer, a provider or both.

1. Map your cloud services to your certification scope. Identify which services you buy, which you provide, and which of them sit inside the scope of your ISO/IEC 27001 certification.

2. Compare your current cloud controls with edition 2. Work through the additional guidance for relevant controls specified in ISO/IEC 27002:2022, then the additional controls written specifically for cloud services.

3. Adjust where you run a private cloud. The controls and guidance of the document are applicable there too, although adjustments can be necessary to adapt to the relationships and abilities of an organisation’s internal departments.

4. Update how your controls are documented and evidenced. Since the document does not stand alone as a certification, the practical task is to keep cloud controls demonstrable within the scope of your ISO/IEC 27001 certification.

5. Brief the teams that own your cloud relationships, so that customers and providers work from the same common understanding of the controls.

Frequently asked questions

Is ISO/IEC 27017 a requirements standard?

No. It is a code of practice, which means it provides guidance rather than requirements. Organisations demonstrate its cloud controls within the scope of their ISO/IEC 27001 certification, and the document itself provides additional guidance for relevant controls in ISO/IEC 27002:2022 alongside additional cloud-specific controls.

Does the new edition apply to the private cloud?

Yes. The document applies to all types of cloud deployment models including the private cloud. When it is applied to a private cloud, the controls and guidance are applicable, although adjustments can be necessary to adapt to the relationships and abilities of an organisation’s internal departments.

What happened to ISO/IEC 27017:2015?

ISO/IEC 27017:2015 is the previous edition. Edition 2 was published on 27 July 2026 and updates the basis for the guidance to ISO/IEC 27002:2022, so organisations working from the earlier text should review their cloud controls against the current edition.

How ITMAD can help

ITMAD supports organisations that need to apply this revision in practice. Because the cloud controls described in the document are demonstrated within the scope of ISO/IEC 27001 certification, our certification teams can review how those controls are applied and evidenced across your cloud services, as a customer, a provider or both. Our training programmes equip the information security, compliance, IT and quality teams that own cloud relationships to work confidently with the controls and guidance in edition 2.