Framework · Last verified
ISO/IEC 27017
ISO/IEC 27017 gives cloud-specific security controls on top of ISO/IEC 27002; the current edition is 27017:2026 — the 2015 text is withdrawn. The version matters: ISO's page marks 27017:2015 "Withdrawn" and "Revised by ISO/IEC 27017:2026" (Edition 2, published July 2026). Per ISO's own description, the guidance addresses both cloud service customers and cloud service providers.
- Class
- Framework
- Owner
- ISO/IEC (Joint Technical Committee ISO/IEC JTC 1)
- Last verified
What it is
The official title of the current edition is "Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for cloud services" (Edition 2, publication date 2026-07, status Published — ISO's page, read in a browser on 7 September 2026).
ISO's own description, verbatim: "It builds on ISO/IEC 27002 by adding cloud-specific guidance and additional controls for both cloud service customers and cloud service providers."
The Estonian national catalogue (EVS) lists the 2026 edition as effective 27.07.2026 and marks the 2015 edition "Withdrawn, superseded" — a supersession several published third-party guides had not yet reflected when this record was verified.
The 2015 edition carried a different title generation ("Code of practice for information security controls...") — quoted here only as history; the current title no longer uses "code of practice".
Who owns it
ISO and IEC jointly, through ISO/IEC JTC 1; national mirror editions exist (EVS entry cited above).
Who asks for it
Public cloud-assurance frameworks name it: Canada's CCCS SPIN 2017-01 lists ISO/IEC 27017 among the third-party assurance forms a department may leverage (carried with its own quote on the linked cccs-cloud record).
Sources
- ISO — ISO/IEC 27017:2026 (standard page; opened via a real browser) ↗ — accessed
- ISO — ISO/IEC 27017:2015 (Status: Withdrawn; "Revised by ISO/IEC 27017:2026") ↗ — accessed
- EVS catalogue — ISO/IEC 27017:2026 (effective 27.07.2026; 2015 marked superseded) ↗ — accessed
Last verified:
This page is for information only; it does not accredit, certify or endorse any organisation. Requirements and programs change — always confirm against the primary source linked above.