ISO/IEC 27017, security in the cloud
The controls specific to anyone working in the cloud, with evidence that comes from your Microsoft 365 and Google Workspace environments and not from a declaration.
For those who use and those who provide cloud services
ISO/IEC 27017 is a code of practice that extends the controls of ISO/IEC 27002 to the world of cloud services. It addresses two parties: the cloud service provider and the customer who uses it, and for each control it clarifies what is up to one and what is up to the other.
It is typically applied together with ISO/IEC 27001, as an extension of the management system for organisations whose data and services are in the cloud, and often alongside ISO/IEC 27018, which deals with personal data.
The starting point is simple and often forgotten: moving data to the cloud does not move the responsibility. It stays with whoever processes the data.
The ISO 27017 cloud security controls
- A clear split of responsibilities between customer and provider
- Management of administrative access to cloud environments
- Segregation of virtual environments between different customers
- Secure configuration of virtual machines and services
- Return and deletion of data at the end of the service
- Tools for the customer to monitor the cloud service
- Information to the customer on availability and incidents
- Consistent security between virtual and physical networks
Cloud postures count as evidence
Beyond the self-assessment, ISO 27017 is the standard where the Microsoft Entra ID and Google Workspace checks become evidence directly.
| ISO 27017 requirement | How Dottor Box covers it |
|---|---|
| Measuring the gap | Gap analysis on the cloud controls, on coverage and maturity |
| Administrative access | Microsoft Entra ID: privileged identities, MFA, Conditional Access, guest accounts, across 72 read-only indicators |
| Secure configuration | Google Workspace: 35 indicators from the CIS catalogue, from identities and administrators to sharing and monitoring |
| Third-party apps and sharing | OAuth consents granted to applications and external file sharing, checked and documented in PDF |
| Responsibilities and cloud suppliers | Supply Chain: qualification questionnaires for your cloud service suppliers |
| Procedures and SoA | Compliance and GRC: ISO 27017 is one of the module's standards, with controls and a Statement of Applicability |
The checks run automatically every week (Entra ID on Monday, Google Workspace on Tuesday) and can be started manually. When a finding has been reviewed and accepted with a reason, it no longer counts towards the score but flags itself again if that configuration changes. And if a piece of data is not available, the indicator shows as "not assessable", not as passed.
The Dottor Box public status page
ISO 27017 asks the cloud provider to give the customer the tools to monitor the service and to inform them of service disruptions. Dottor Marc does this with a public status page, hosted outside the platform's infrastructure: it stays reachable even when the service is not, which is exactly when you need it.
Incidents follow a declared cycle, Identified, Investigating, Monitoring, Resolved: communication about a disruption is structured, not improvised.
The provider applies to itself the control it helps you apply.
The cloud explained to the auditor
Evidence, not declarations
Microsoft 365 and Google Workspace configurations checked and documented, week after week.
Privileges under control
Who is an administrator, who has two-step verification, which apps have access to the data.
Clear responsibilities
What is up to you and what is up to the provider, with questionnaires that put it in writing.
An example to follow
An independent status page: the practical way a provider keeps its customers informed.
ISO 27017: frequently asked questions
Can you be certified to ISO 27017 on its own?
As a rule it is attested as an extension of an ISO/IEC 27001 management system, which remains the reference certification.
I use Microsoft 365: isn't security Microsoft's job?
In part. The provider protects the infrastructure; configurations, users, privileges, authorised apps and sharing remain your responsibility. That is exactly the split that ISO 27017 asks you to make explicit.
The modules that work for ISO 27017
Microsoft Entra ID
The security posture of your Microsoft 365 tenant across 72 indicators, read-only.
Learn more SeeGoogle Workspace
35 checks from the CIS benchmark on your Google Workspace configuration, email included.
Learn more GovernCompliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn more GovernSupply Chain
Supplier assessment with questionnaires completed from a link, no accounts needed.
Learn more ComplianceISO/IEC 27018
Protection of personal data in the public cloud.
Learn more ComplianceISO/IEC 27001
The information security management system, from the SoA to the audit.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.