ISO/IEC 27017 is a standard that provides guidelines for information security controls applicable to the provision and use of cloud services. It is an extension of ISO/IEC 27002, tailored specifically to address the unique aspects of cloud computing, both for cloud service providers (CSPs) and cloud service customers (CSCs).
Key Components of ISO/IEC 27017
- Introduction:
- Purpose: Explains the objective of ISO/IEC 27017, which is to provide guidelines for information security controls in cloud services.
- Audience: Intended for cloud service providers and cloud service customers involved in implementing and managing information security in cloud environments.
- Scope:
- Applicability: Applicable to all types of organizations, regardless of size, industry, or sector, that provide or use cloud services.
- Normative References:
- ISO/IEC 27000: References terms and definitions used throughout the ISO/IEC 27000 family of standards.
Structure and Content
ISO/IEC 27017 provides additional implementation guidance for the controls specified in ISO/IEC 27002, as well as additional controls specifically for cloud services. It is structured around the same 14 control domains as ISO/IEC 27002, with specific cloud-related guidelines and controls.
- Clause 5: Information Security Policies for Cloud Services:
- Cloud-Specific Policies: Establish policies specific to cloud services, addressing the unique security requirements of cloud environments.
- Clause 6: Organization of Information Security for Cloud Services:
- Roles and Responsibilities: Define and document roles and responsibilities for both CSPs and CSCs.
- Cloud Service Agreements: Ensure security responsibilities are clearly defined in cloud service agreements.
- Clause 7: Human Resource Security:
- Cloud-Specific Training: Provide training on cloud-specific security practices for personnel involved in cloud services.
- Clause 8: Asset Management:
- Cloud Service Asset Management: Manage cloud service assets, including virtual machines, storage, and network resources.
- Clause 9: Access Control:
- Cloud Access Controls: Implement access controls specific to cloud environments, including multi-factor authentication and role-based access control.
- Segregation in Virtual Environments: Ensure appropriate segregation of duties and environments in cloud services.
- Clause 10: Cryptography:
- Encryption in the Cloud: Use encryption to protect data in transit and at rest in cloud environments.
- Key Management: Implement robust key management practices for cloud services.
- Clause 11: Physical and Environmental Security:
- Cloud Data Center Security: Ensure physical security controls are implemented at cloud data centers.
- Clause 12: Operations Security:
- Cloud Operations: Implement operational procedures specific to cloud environments, including patch management and vulnerability management.
- Cloud Monitoring and Logging: Monitor and log cloud service activities to detect and respond to security incidents.
- Clause 13: Communications Security:
- Cloud Network Security: Ensure the security of network communications in cloud environments, including virtual private networks (VPNs) and secure APIs.
- Clause 14: System Acquisition, Development, and Maintenance:
- Cloud Development and Testing: Ensure secure development and testing practices for cloud-based applications.
- Change Management in the Cloud: Implement change management processes for cloud services.
- Clause 15: Supplier Relationships:
- Cloud Supplier Management: Manage security risks associated with third-party cloud service providers.
- Service Level Agreements (SLAs): Define and monitor SLAs for security in cloud service agreements.
- Clause 16: Information Security Incident Management:
- Cloud Incident Response: Develop and implement incident response plans specific to cloud environments.
- Incident Reporting: Ensure incidents are reported and managed according to established procedures.
- Clause 17: Information Security Aspects of Business Continuity Management:
- Cloud Continuity Planning: Develop business continuity plans that address the use of cloud services.
- Disaster Recovery in the Cloud: Implement disaster recovery solutions specific to cloud environments.
- Clause 18: Compliance:
- Legal and Regulatory Compliance: Ensure compliance with legal, regulatory, and contractual requirements related to cloud services.
- Cloud-Specific Audits: Conduct audits specific to the cloud service environment to ensure compliance and security.
Detailed Guidance
- Cloud Service Models:
- IaaS, PaaS, and SaaS: Address specific security considerations for Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) models.
- Shared Responsibility Model: Clearly define the shared responsibilities between CSPs and CSCs.
- Data Protection:
- Data Ownership: Ensure clear ownership and control over data stored in the cloud.
- Data Deletion: Implement secure data deletion and disposal practices for cloud environments.
- Identity and Access Management (IAM):
- IAM in the Cloud: Implement IAM practices tailored to cloud services, including federated identity management and access reviews.
- Cloud Security Architecture:
- Architectural Considerations: Design security architectures that address the unique challenges of cloud environments.
- Secure Configuration: Ensure secure configuration of cloud services and resources.
- Continuous Monitoring and Improvement:
- Cloud Security Monitoring: Continuously monitor cloud environments for security threats and vulnerabilities.
- Improvement Processes: Implement processes for continuous improvement of cloud security practices.
Benefits of ISO/IEC 27017
- Enhanced Cloud Security: Provides specific guidance for securing cloud environments, addressing the unique challenges and risks of cloud services.
- Compliance: Supports compliance with ISO/IEC 27001 and other relevant standards and regulations for cloud security.
- Shared Responsibility Clarity: Clarifies the shared responsibilities between CSPs and CSCs, ensuring both parties understand and fulfill their security obligations.
- Risk Management: Enhances the organization’s ability to manage information security risks associated with cloud services.
- Stakeholder Confidence: Builds confidence among stakeholders by demonstrating a commitment to securing cloud services and protecting sensitive data.
ISO/IEC 27017 is a valuable resource for organizations seeking to implement robust security controls in cloud environments, ensuring the continuous protection and integrity of their information assets.
