> ## Documentation Index
> Fetch the complete documentation index at: https://help.dsalta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ISO 27017:2015

> Apply cloud-specific security controls as an extension to ISO 27001.

> Apply cloud-specific security controls as an extension to ISO 27001.

ISO/IEC 27017 is a code of practice that provides cloud-specific information security controls. It supplements the guidance in ISO 27002 with additional controls and implementation guidance for both cloud service providers and cloud service customers.

<Note>
  ISO 27017 is not independently certifiable — it is implemented alongside an ISO 27001 ISMS to address cloud-specific risks.
</Note>

## Who needs ISO 27017:2015?

<CardGroup cols={2}>
  <Card title="Cloud providers" icon="cloud">
    Organizations offering cloud services that want to demonstrate cloud-specific security.
  </Card>

  <Card title="Cloud customers" icon="users">
    Organizations using cloud services that need guidance on their security responsibilities.
  </Card>
</CardGroup>

## Key components

<CardGroup cols={3}>
  <Card title="Shared responsibility" icon="users-gear">
    Clarifies the division of security responsibilities between provider and customer.
  </Card>

  <Card title="Cloud controls" icon="cloud">
    Additional implementation guidance for 37 ISO 27002 controls in a cloud context.
  </Card>

  <Card title="Seven new controls" icon="plus">
    Cloud-specific controls not found in ISO 27002, such as virtual machine hardening.
  </Card>

  <Card title="Customer guidance" icon="circle-info">
    Helps customers understand and configure their cloud security posture.
  </Card>
</CardGroup>

## How DSALTA helps with ISO 27017:2015

<Steps>
  <Step title="Activate ISO 27017">
    Select ISO 27017 alongside your ISO 27001 ISMS. DSALTA maps cloud controls.
  </Step>

  <Step title="Review cloud controls">
    Review the cloud-specific controls and assign owners.
  </Step>

  <Step title="Collect evidence automatically">
    Connect cloud integrations to gather evidence for cloud controls.
  </Step>

  <Step title="Approve policies">
    Review and approve cloud security policies.
  </Step>

  <Step title="Prepare for audit">
    Share cloud control evidence with your certification body.
  </Step>
</Steps>

## Frequently asked questions

<AccordionGroup>
  <Accordion title="Is ISO 27017 a standalone certification?" icon="certificate">
    No. It is implemented as an extension to ISO 27001 and assessed as part of that certification.
  </Accordion>

  <Accordion title="How is 27017 different from 27018?" icon="code-compare">
    27017 covers cloud security broadly, while 27018 focuses specifically on protecting personal data (PII) in public clouds.
  </Accordion>
</AccordionGroup>

## Related pages

* [Active Frameworks](/guides/compliance/frameworks-active)
* [Available Frameworks](/guides/compliance/frameworks-available)
* [Controls](/guides/compliance/controls)
* [Audits](/guides/compliance/audits)