How Is the Updated International Standard Reshaping Modern Cloud Architecture Security and Certification?
The widespread adoption of cloud-based technologies – driven in particular by the rapid growth of artificial intelligence applications and the migration of critical business systems – has fundamentally transformed enterprise IT strategies. As organisations increasingly rely on external cloud service providers to store and process sensitive data, security challenges have also reached a new level. The ISO/IEC 27017:2026 standard addresses these challenges by providing the first comprehensive update to the cloud security standard, bringing it in line with the latest technological realities and the structure introduced by ISO/IEC 27002:2022.
What Is ISO/IEC 27017 and Why Is It So Important?
ISO/IEC 27017 focuses specifically on security considerations for cloud-based services. Building on the ISO/IEC 27002 framework – which also underpins the controls referenced in Annex A of ISO/IEC 27001 – it provides additional, cloud-specific guidance for both Cloud Service Providers (CSPs) and Cloud Service Customers (CSCs).
One of the key principles underpinning the standard is the shared responsibility model. It clearly distinguishes between the following roles:
- CSC (Cloud Service Customer): The organisation that purchases or uses cloud services.
- CSP (Cloud Service Provider): The organisation providing the underlying infrastructure and services, such as AWS, Microsoft Azure or Google Cloud.
- CSN (Cloud Service Partner): Supporting organisations involved in the cloud ecosystem, such as cloud brokers or developers.
Key Changes in the ISO/IEC 27017:2026 Edition
Since the publication of the 2015 edition, this is the first major revision of the standard. The update is not merely cosmetic: it introduces both structural and substantive changes to align the standard with today’s multi-cloud and hybrid cloud environments.
Key changes include:
- Structural alignment: Full alignment with the organisational, people, physical and technological control structure of ISO/IEC 27002:2022, significantly facilitating integration with existing ISO/IEC 27001 management systems.
- Modernised governance: Enhanced guidance on virtualisation, configuration management, monitoring and cloud governance.
- Clearer allocation of responsibilities: More explicit guidance on how security responsibilities are divided between the parties, helping to prevent security gaps arising from misunderstandings or unclear ownership.
The Introduction of New “CLD” Controls
One of the most significant changes in the 2026 edition is the introduction of four dedicated cloud-specific controls carrying the CLD (Cloud Extended Controls) designation. These address areas that cannot be adequately covered by traditional IT controls alone.
CLD.5.38: Shared Roles and Responsibilities within a Cloud Computing Environment
This control formalises the principle of shared responsibility. It requires both the CSC and the CSP to formally define, document, communicate and implement their respective security roles and responsibilities.
This removes ambiguity over which party is responsible for a particular security activity.
CLD.5.39: Agreement of Roles and Responsibilities of the Cloud Service Partner
This is an entirely new control with no direct predecessor in the 2015 edition. It governs the information security roles and responsibilities of third-party cloud partners (CSNs), such as cloud brokers, auditors or developers, helping to ensure effective governance across complex digital ecosystems.
CLD.8.35: Segregation in Virtual Computing Environments
This control addresses the fundamental security challenges associated with multi-tenant architectures. It requires CSPs to ensure effective logical separation between tenants – including at the data, application, operating system, storage and network levels – as well as strict segregation between customer environments and the provider’s administrative systems.
CLD.8.36: Detection and Prevention of Unauthorised Use of Cloud Services
This control focuses on the detection and prevention of unauthorised use of cloud services. It encourages organisations to implement appropriate mechanisms to identify and prevent the unauthorised use of cloud services, unusual resource consumption, unauthorised data transfers and the use of shadow IT – cloud applications or services used without organisational approval.
Relationship with ISO/IEC 27001 and Certification Considerations
It is important to emphasise that ISO/IEC 27017 is not a standalone certifiable information security management system standard. Rather, it provides cloud-specific controls and implementation guidance based on ISO/IEC 27002. It can be integrated into an information security management system (ISMS) established in accordance with ISO/IEC 27001.
In practice, organisations can apply the cloud-specific controls within their ISO/IEC 27001 framework, taking into account the specific risks associated with cloud services and the shared responsibilities between the service provider and the customer.
Conformity assessment is typically carried out as an extension of an existing ISO/IEC 27001-based ISMS. As part of, or in conjunction with, an ISO/IEC 27001 audit, certification bodies may assess how the cloud-specific controls and guidance of ISO/IEC 27017 have been applied.
This enables an organisation to demonstrate that its information security management system effectively addresses the specific security and risk management considerations associated with cloud services.
