{"id":1213,"date":"2026-09-15T08:31:10","date_gmt":"2026-09-15T08:31:10","guid":{"rendered":"https:\/\/awaretium.eu\/en\/?p=1213"},"modified":"2026-09-15T08:31:10","modified_gmt":"2026-09-15T08:31:10","slug":"post-6","status":"publish","type":"post","link":"https:\/\/awaretium.eu\/en\/post-6\/","title":{"rendered":"The Significance of ISO\/IEC 27017:2026: New Cloud Security Controls"},"content":{"rendered":"\n<h5 class=\"wp-block-heading has-pale-cyan-blue-color has-text-color has-link-color wp-elements-1\">How Is the Updated International Standard Reshaping Modern Cloud Architecture Security and Certification?<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">The widespread adoption of cloud-based technologies \u2013 driven in particular by the rapid growth of artificial intelligence applications and the migration of critical business systems \u2013 has fundamentally transformed enterprise IT strategies. As organisations increasingly rely on external cloud service providers to store and process sensitive data, security challenges have also reached a new level. The <strong>ISO\/IEC 27017:2026 <\/strong>standard addresses these challenges by providing the first comprehensive update to the cloud security standard, bringing it in line with the latest technological realities and the structure introduced by ISO\/IEC 27002:2022.<\/p>\n\n\n\n<h4 class=\"wp-block-heading has-pale-cyan-blue-color has-text-color has-link-color wp-elements-2\">What Is ISO\/IEC 27017 and Why Is It So Important?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">ISO\/IEC 27017 focuses specifically on security considerations for cloud-based services. Building on the ISO\/IEC 27002 framework \u2013 which also underpins the controls referenced in Annex A of ISO\/IEC 27001 \u2013 it provides additional, cloud-specific guidance for both Cloud Service Providers (CSPs) and Cloud Service Customers (CSCs).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One of the key principles underpinning the standard is the shared responsibility model. It clearly distinguishes between the following roles:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CSC (Cloud Service Customer): The organisation that purchases or uses cloud services.<\/li>\n\n\n\n<li>CSP (Cloud Service Provider): The organisation providing the underlying infrastructure and services, such as AWS, Microsoft Azure or Google Cloud.<\/li>\n\n\n\n<li>CSN (Cloud Service Partner): Supporting organisations involved in the cloud ecosystem, such as cloud brokers or developers.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h4 class=\"wp-block-heading has-pale-cyan-blue-color has-text-color has-link-color wp-elements-3\">Key Changes in the ISO\/IEC 27017:2026 Edition<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Since the publication of the 2015 edition, this is the first major revision of the standard. The update is not merely cosmetic: it introduces both structural and substantive changes to align the standard with today&#8217;s multi-cloud and hybrid cloud environments.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Key changes include:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Structural alignment: <\/strong>Full alignment with the organisational, people, physical and technological control structure of ISO\/IEC 27002:2022, significantly facilitating integration with existing ISO\/IEC 27001 management systems.<\/li>\n\n\n\n<li><strong>Modernised governance:<\/strong> Enhanced guidance on virtualisation, configuration management, monitoring and cloud governance.<\/li>\n\n\n\n<li><strong>Clearer allocation of responsibilities:<\/strong> More explicit guidance on how security responsibilities are divided between the parties, helping to prevent security gaps arising from misunderstandings or unclear ownership.<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n<h4 class=\"wp-block-heading has-pale-cyan-blue-color has-text-color has-link-color wp-elements-4\">The Introduction of New \u201cCLD\u201d Controls<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">One of the most significant changes in the 2026 edition is the introduction of four dedicated cloud-specific controls carrying the <strong>CLD (Cloud Extended Controls)<\/strong> designation. These address areas that cannot be adequately covered by traditional IT controls alone.<\/p>\n\n\n\n<h5 class=\"wp-block-heading has-pale-cyan-blue-color has-text-color has-link-color wp-elements-5\">CLD.5.38: Shared Roles and Responsibilities within a Cloud Computing Environment<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">This control formalises the principle of shared responsibility. It requires both the CSC and the CSP to formally define, document, communicate and implement their respective security roles and responsibilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This removes ambiguity over which party is responsible for a particular security activity.<\/p>\n\n\n\n<h5 class=\"wp-block-heading has-pale-cyan-blue-color has-text-color has-link-color wp-elements-6\">CLD.5.39: Agreement of Roles and Responsibilities of the Cloud Service Partner<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">This is an entirely new control with no direct predecessor in the 2015 edition. It governs the information security roles and responsibilities of third-party cloud partners (CSNs), such as cloud brokers, auditors or developers, helping to ensure effective governance across complex digital ecosystems.<\/p>\n\n\n\n<h5 class=\"wp-block-heading has-pale-cyan-blue-color has-text-color has-link-color wp-elements-7\">CLD.8.35: Segregation in Virtual Computing Environments<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">This control addresses the fundamental security challenges associated with multi-tenant architectures. It requires CSPs to ensure effective logical separation between tenants \u2013 including at the data, application, operating system, storage and network levels \u2013 as well as strict segregation between customer environments and the provider&#8217;s administrative systems.<\/p>\n\n\n\n<h5 class=\"wp-block-heading has-pale-cyan-blue-color has-text-color has-link-color wp-elements-8\">CLD.8.36: Detection and Prevention of Unauthorised Use of Cloud Services<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">This control focuses on the detection and prevention of unauthorised use of cloud services. It encourages organisations to implement appropriate mechanisms to identify and prevent the unauthorised use of cloud services, unusual resource consumption, unauthorised data transfers and the use of shadow IT \u2013 cloud applications or services used without organisational approval.<\/p>\n\n\n\n<h4 class=\"wp-block-heading has-pale-cyan-blue-color has-text-color has-link-color wp-elements-9\">Relationship with ISO\/IEC 27001 and Certification Considerations<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">It is important to emphasise that <strong>ISO\/IEC 27017 is not a standalone certifiable information security management system standard<\/strong>. Rather, it provides cloud-specific controls and implementation guidance based on ISO\/IEC 27002. It can be integrated into an information security management system (ISMS) established in accordance with ISO\/IEC 27001.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In practice, organisations can apply the cloud-specific controls within their ISO\/IEC 27001 framework, taking into account the specific risks associated with cloud services and the shared responsibilities between the service provider and the customer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Conformity assessment is typically carried out as an extension of an existing ISO\/IEC 27001-based ISMS. As part of, or in conjunction with, an ISO\/IEC 27001 audit, certification bodies may assess how the cloud-specific controls and guidance of ISO\/IEC 27017 have been applied.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This enables an organisation to demonstrate that its information security management system effectively addresses the specific security and risk management considerations associated with cloud services.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>How Is the Updated International Standard Reshaping Modern Cloud Architecture Security and Certification? The widespread adoption of cloud-based technologies \u2013 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1215,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"no-sidebar","site-content-layout":"","ast-site-content-layout":"narrow-width-container","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1213","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"spectra_blocks_featured_image_url":{"thumbnail":{"url":"https:\/\/awaretium.eu\/en\/wp-content\/uploads\/2026\/09\/blog_cloud_data_center-150x150.jpg","width":150,"height":150},"medium":{"url":"https:\/\/awaretium.eu\/en\/wp-content\/uploads\/2026\/09\/blog_cloud_data_center-300x242.jpg","width":300,"height":242},"medium_large":{"url":"https:\/\/awaretium.eu\/en\/wp-content\/uploads\/2026\/09\/blog_cloud_data_center-768x619.jpg","width":768,"height":619},"large":{"url":"https:\/\/awaretium.eu\/en\/wp-content\/uploads\/2026\/09\/blog_cloud_data_center-1024x825.jpg","width":1024,"height":825},"full":{"url":"https:\/\/awaretium.eu\/en\/wp-content\/uploads\/2026\/09\/blog_cloud_data_center.jpg","width":2304,"height":1856}},"spectra_blocks_author_info":{"display_name":"Bed\u0151 Ferenc","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/12f83d1ffd21c12319a9f540ce896f49ba314762fc6622a9af34fdca0b99abca?s=96&d=mm&r=g","author_link":"https:\/\/awaretium.eu\/en\/author\/admin_7vlukqq1\/","description":""},"uagb_featured_image_src":{"full":["https:\/\/awaretium.eu\/en\/wp-content\/uploads\/2026\/09\/blog_cloud_data_center.jpg",2304,1856,false],"thumbnail":["https:\/\/awaretium.eu\/en\/wp-content\/uploads\/2026\/09\/blog_cloud_data_center-150x150.jpg",150,150,true],"medium":["https:\/\/awaretium.eu\/en\/wp-content\/uploads\/2026\/09\/blog_cloud_data_center-300x242.jpg",300,242,true],"medium_large":["https:\/\/awaretium.eu\/en\/wp-content\/uploads\/2026\/09\/blog_cloud_data_center-768x619.jpg",768,619,true],"large":["https:\/\/awaretium.eu\/en\/wp-content\/uploads\/2026\/09\/blog_cloud_data_center-1024x825.jpg",1024,825,true],"1536x1536":["https:\/\/awaretium.eu\/en\/wp-content\/uploads\/2026\/09\/blog_cloud_data_center-1536x1237.jpg",1536,1237,true],"2048x2048":["https:\/\/awaretium.eu\/en\/wp-content\/uploads\/2026\/09\/blog_cloud_data_center-2048x1650.jpg",2048,1650,true]},"uagb_author_info":{"display_name":"Bed\u0151 Ferenc","author_link":"https:\/\/awaretium.eu\/en\/author\/admin_7vlukqq1\/"},"uagb_comment_info":0,"uagb_excerpt":"How Is the Updated International Standard Reshaping Modern Cloud Architecture Security and Certification? The widespread adoption of cloud-based technologies \u2013 [&hellip;]","_links":{"self":[{"href":"https:\/\/awaretium.eu\/en\/wp-json\/wp\/v2\/posts\/1213","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/awaretium.eu\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/awaretium.eu\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/awaretium.eu\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/awaretium.eu\/en\/wp-json\/wp\/v2\/comments?post=1213"}],"version-history":[{"count":2,"href":"https:\/\/awaretium.eu\/en\/wp-json\/wp\/v2\/posts\/1213\/revisions"}],"predecessor-version":[{"id":1216,"href":"https:\/\/awaretium.eu\/en\/wp-json\/wp\/v2\/posts\/1213\/revisions\/1216"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/awaretium.eu\/en\/wp-json\/wp\/v2\/media\/1215"}],"wp:attachment":[{"href":"https:\/\/awaretium.eu\/en\/wp-json\/wp\/v2\/media?parent=1213"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/awaretium.eu\/en\/wp-json\/wp\/v2\/categories?post=1213"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/awaretium.eu\/en\/wp-json\/wp\/v2\/tags?post=1213"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}