ISO/IEC 27017: Code of practice for information security controls based on ISO/IEC 27002 for cloud services

ISO/IEC 27017 is a standard that provides guidelines for information security controls applicable to the provision and use of cloud services. It is an extension of ISO/IEC 27002, tailored specifically to address the unique aspects of cloud computing, both for cloud service providers (CSPs) and cloud service customers (CSCs).

Key Components of ISO/IEC 27017

1. Introduction:
   • Purpose: Explains the objective of ISO/IEC 27017, which is to provide guidelines for information security controls in cloud services.
   • Audience: Intended for cloud service providers and cloud service customers involved in implementing and managing information security in cloud environments.
2. Scope:
   • Applicability: Applicable to all types of organizations, regardless of size, industry, or sector, that provide or use cloud services.
3. Normative References:
   • ISO/IEC 27000: References terms and definitions used throughout the ISO/IEC 27000 family of standards.

Structure and Content

ISO/IEC 27017 provides additional implementation guidance for the controls specified in ISO/IEC 27002, as well as additional controls specifically for cloud services. It is structured around the same 14 control domains as ISO/IEC 27002, with specific cloud-related guidelines and controls.

1. Clause 5: Information Security Policies for Cloud Services:
   • Cloud-Specific Policies: Establish policies specific to cloud services, addressing the unique security requirements of cloud environments.
2. Clause 6: Organization of Information Security for Cloud Services:
   • Roles and Responsibilities: Define and document roles and responsibilities for both CSPs and CSCs.
   • Cloud Service Agreements: Ensure security responsibilities are clearly defined in cloud service agreements.
3. Clause 7: Human Resource Security:
   • Cloud-Specific Training: Provide training on cloud-specific security practices for personnel involved in cloud services.
4. Clause 8: Asset Management:
   • Cloud Service Asset Management: Manage cloud service assets, including virtual machines, storage, and network resources.
5. Clause 9: Access Control:
   • Cloud Access Controls: Implement access controls specific to cloud environments, including multi-factor authentication and role-based access control.
   • Segregation in Virtual Environments: Ensure appropriate segregation of duties and environments in cloud services.
6. Clause 10: Cryptography:
   • Encryption in the Cloud: Use encryption to protect data in transit and at rest in cloud environments.
   • Key Management: Implement robust key management practices for cloud services.
7. Clause 11: Physical and Environmental Security:
   • Cloud Data Center Security: Ensure physical security controls are implemented at cloud data centers.
8. Clause 12: Operations Security:
   • Cloud Operations: Implement operational procedures specific to cloud environments, including patch management and vulnerability management.
   • Cloud Monitoring and Logging: Monitor and log cloud service activities to detect and respond to security incidents.
9. Clause 13: Communications Security:
   • Cloud Network Security: Ensure the security of network communications in cloud environments, including virtual private networks (VPNs) and secure APIs.
10. Clause 14: System Acquisition, Development, and Maintenance:
    • Cloud Development and Testing: Ensure secure development and testing practices for cloud-based applications.
    • Change Management in the Cloud: Implement change management processes for cloud services.
11. Clause 15: Supplier Relationships:
    • Cloud Supplier Management: Manage security risks associated with third-party cloud service providers.
    • Service Level Agreements (SLAs): Define and monitor SLAs for security in cloud service agreements.
12. Clause 16: Information Security Incident Management:
    • Cloud Incident Response: Develop and implement incident response plans specific to cloud environments.
    • Incident Reporting: Ensure incidents are reported and managed according to established procedures.
13. Clause 17: Information Security Aspects of Business Continuity Management:
    • Cloud Continuity Planning: Develop business continuity plans that address the use of cloud services.
    • Disaster Recovery in the Cloud: Implement disaster recovery solutions specific to cloud environments.
14. Clause 18: Compliance:
    • Legal and Regulatory Compliance: Ensure compliance with legal, regulatory, and contractual requirements related to cloud services.
    • Cloud-Specific Audits: Conduct audits specific to the cloud service environment to ensure compliance and security.

Detailed Guidance

1. Cloud Service Models:
   • IaaS, PaaS, and SaaS: Address specific security considerations for Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) models.
   • Shared Responsibility Model: Clearly define the shared responsibilities between CSPs and CSCs.
2. Data Protection:
   • Data Ownership: Ensure clear ownership and control over data stored in the cloud.
   • Data Deletion: Implement secure data deletion and disposal practices for cloud environments.
3. Identity and Access Management (IAM):
   • IAM in the Cloud: Implement IAM practices tailored to cloud services, including federated identity management and access reviews.
4. Cloud Security Architecture:
   • Architectural Considerations: Design security architectures that address the unique challenges of cloud environments.
   • Secure Configuration: Ensure secure configuration of cloud services and resources.
5. Continuous Monitoring and Improvement:
   • Cloud Security Monitoring: Continuously monitor cloud environments for security threats and vulnerabilities.
   • Improvement Processes: Implement processes for continuous improvement of cloud security practices.

Benefits of ISO/IEC 27017

• Enhanced Cloud Security: Provides specific guidance for securing cloud environments, addressing the unique challenges and risks of cloud services.
• Compliance: Supports compliance with ISO/IEC 27001 and other relevant standards and regulations for cloud security.
• Shared Responsibility Clarity: Clarifies the shared responsibilities between CSPs and CSCs, ensuring both parties understand and fulfill their security obligations.
• Risk Management: Enhances the organization’s ability to manage information security risks associated with cloud services.
• Stakeholder Confidence: Builds confidence among stakeholders by demonstrating a commitment to securing cloud services and protecting sensitive data.

ISO/IEC 27017 is a valuable resource for organizations seeking to implement robust security controls in cloud environments, ensuring the continuous protection and integrity of their information assets.