prEN ISO/IEC 27017

Information security, cybersecurity and privacy protection - Information security controls based on ISO/IEC 27002 for cloud services (ISO/IEC DIS 27017:2025)

ISO/IEC 27017:2015 gives guidelines for information security controls applicable to the provision and use of cloud services by providing:
- additional implementation guidance for relevant controls specified in ISO/IEC 27002;
- additional controls with implementation guidance that specifically relate to cloud services.
This Recommendation | International Standard provides controls and implementation guidance for both cloud service providers and cloud service customers.

Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre - Informationssicherheitsmaßnahmen auf der Grundlage von ISO/IEC 27002 für Cloud-Dienste (ISO/IEC DIS 27017:2025)

Sécurité de l'information, cybersécurité et protection de la vie privée - Contrôles de sécurité de l'information fondés sur l'ISO/IEC 27002 pour les services du nuage (ISO/IEC DIS 27017:2025)

La présente Recommandation | Norme internationale contient des lignes directrices relatives aux mesures de sécurité de l'information applicables à la prestation et à l'utilization de services d'informatique en nuage, par exemple:
—          des recommandations supplémentaires concernant la mise en œuvre des mesures de sécurité pertinentes spécifiées dans l'ISO/IEC 27002;
—          des mesures de sécurité supplémentaires avec préconisations de mise en œuvre spécifiquement liées aux services en nuage.
La présente Recommandation | Norme internationale fournit des recommandations concernant les moyens de maîtrise et la mise en œuvre destinées aux prestataires de services d'informatique en nuage et à leurs clients.

Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Kontrole informacijske varnosti, ki temeljijo na ISO/IEC 27002 za storitve v oblaku (ISO/IEC DIS 27017:2025)

General Information

• Status: Not Published
• Publication Date: 06-Sep-2026
• ICS: 35.030 - IT Security
• Technical Committee: CEN/CLC/TC 13 - Cybersecurity and Data Protection
• Current Stage: 4020 - Submission to enquiry - Enquiry
• Start Date: 06-Feb-2025
• Due Date: 06-Feb-2025
• Completion Date: 06-Feb-2025
• Ref Project: oSIST prEN ISO/IEC 27017:2025 - Information security, cybersecurity and privacy protection - Information security controls based on ISO/IEC 27002 for cloud services (ISO/IEC DIS 27017:2025)

Relations

• Revises: EN ISO/IEC 27017:2021 - Information technology - Security techniques - Code of practice for information security controls based on ISO/IEC 27002 for cloud services (ISO/IEC 27017:2015)
• Effective Date: 01-May-2024

Standards Content (Sample)

SLOVENSKI STANDARD
01-april-2025
Informacijska varnost, kibernetska varnost in varstvo zasebnosti - Kontrole
informacijske varnosti, ki temeljijo na ISO/IEC 27002 za storitve v oblaku (ISO/IEC
DIS 27017:2025)
Information security, cybersecurity and privacy protection - Information security controls
based on ISO/IEC 27002 for cloud services (ISO/IEC DIS 27017:2025)
Informationssicherheit, Cybersicherheit und Schutz der Privatsphäre -
Informationssicherheitsmaßnahmen auf der Grundlage von ISO/IEC 27002 für Cloud-
Dienste (ISO/IEC DIS 27017:2025)
Sécurité de l'information, cybersécurité et protection de la vie privée - Contrôles de
sécurité de l'information fondés sur l'ISO/IEC 27002 pour les services du nuage
(ISO/IEC DIS 27017:2025)
Ta slovenski standard je istoveten z: prEN ISO/IEC 27017
ICS:
03.100.70 Sistemi vodenja Management systems
35.030 Informacijska varnost IT Security
35.210 Računalništvo v oblaku Cloud computing
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

DRAFT
International
Standard
ISO/IEC DIS 27017
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection —
Voting begins on:
Information security controls based
2025-02-03
on ISO/IEC 27002 for cloud services
Voting terminates on:
ICS: 35.030
2025-04-28
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENTS AND APPROVAL. IT
IS THEREFORE SUBJECT TO CHANGE
AND MAY NOT BE REFERRED TO AS AN
INTERNATIONAL STANDARD UNTIL
PUBLISHED AS SUCH.
This document is circulated as received from the committee secretariat.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
STANDARDS MAY ON OCCASION HAVE TO
ISO/CEN PARALLEL PROCESSING
BE CONSIDERED IN THE LIGHT OF THEIR
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
NATIONAL REGULATIONS.
RECIPIENTS OF THIS DRAFT ARE INVITED
TO SUBMIT, WITH THEIR COMMENTS,
NOTIFICATION OF ANY RELEVANT PATENT
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION.
Reference number
© ISO/IEC 2025
ISO/IEC DIS 27017:2025(en)
DRAFT
ISO/IEC DIS 27017:2025(en)
International
Standard
ISO/IEC DIS 27017
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection —
Voting begins on:
Information security controls based
on ISO/IEC 27002 for cloud services
Voting terminates on:
ICS: 35.030
THIS DOCUMENT IS A DRAFT CIRCULATED
FOR COMMENTS AND APPROVAL. IT
IS THEREFORE SUBJECT TO CHANGE
AND MAY NOT BE REFERRED TO AS AN
INTERNATIONAL STANDARD UNTIL
PUBLISHED AS SUCH.
This document is circulated as received from the committee secretariat.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL,
© ISO/IEC 2025
TECHNOLOGICAL, COMMERCIAL AND
USER PURPOSES, DRAFT INTERNATIONAL
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
STANDARDS MAY ON OCCASION HAVE TO
ISO/CEN PARALLEL PROCESSING
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
BE CONSIDERED IN THE LIGHT OF THEIR
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
POTENTIAL TO BECOME STANDARDS TO
WHICH REFERENCE MAY BE MADE IN
or ISO’s member body in the country of the requester.
NATIONAL REGULATIONS.
ISO copyright office
RECIPIENTS OF THIS DRAFT ARE INVITED
CP 401 • Ch. de Blandonnet 8
TO SUBMIT, WITH THEIR COMMENTS,
CH-1214 Vernier, Geneva
NOTIFICATION OF ANY RELEVANT PATENT
Phone: [phone]
RIGHTS OF WHICH THEY ARE AWARE AND TO
PROVIDE SUPPORTING DOCUMENTATION.
Email: [e-mail]
Website: www.iso.org
Published in Switzerland Reference number
© ISO/IEC 2025
ISO/IEC DIS 27017:2025(en)
© ISO/IEC 2025 – All rights reserved
ii
ISO/IEC DIS 27017:2025(en)
Contents Page
Foreword .vi
Introduction .vii
1 Scope . 1
2 Normative references . 1
3 Terms, definitions and abbreviated terms . 1
3.1 Terms and definitions .1
3.2 Abbreviated terms .2
4 Cloud computing specific concepts . 2
4.1 General .2
4.1.1 Overview .2
4.1.2 Structure of this International Standard.2
4.2 Cloud computing specific concepts .3
4.2.1 Supplier relationships in cloud services .3
4.2.2 Relationships between CSCs and CSPs.3
4.2.3 Managing information security risks in cloud services .4
5 Cloud service specific guidance related to organizational controls . 5
5.1 Policies for information security . .5
5.2 Information security roles and responsibilities .6
5.3 Segregation of duties.6
5.4 Management responsibilities .6
5.5 Contact with authorities .6
5.6 Contact with special interest groups . .6
5.7 Threat intelligence .6
5.8 Information security in project management .7
5.9 Inventory of information and other associated assets .7
5.10 Acceptable use of information and other associated assets .7
5.11 Return of assets .7
5.12 Classification of information .8
5.13 Labelling of information .8
5.14 Information transfer .8
5.15 Access control .8
5.16 Identity management .8
5.17 Authentication information .8
5.18 Access rights .9
5.19 Information security in supplier relationships .9
5.20 Addressing information security within supplier agreements .9
5.21 Managing information security in the ICT supply chain .10
5.22 Monitoring, review and change management of supplier services .10
5.23 Information security for use of cloud services .10
5.24 Information security incident management planning and preparation .10
5.25 Assessment and decision on information security events .10
5.26 Response to information security incidents .11
5.27 Learning from information security incidents .11
5.28 Collection of evidence . .11
5.29 Information security during disruption .11
5.30 ICT readiness for business continuity .11
5.31 Identification of legal, statutory, regulatory and contractual requirements .11
5.32 Intellectual property rights . 12
5.33 Protection of records . 13
5.34 Privacy and protection of PII . 13
5.35 Independent review of information security . 13
5.36 Compliance with policies and standards for information security . 13
5.37 Documented operating procedures . 13

© ISO/IEC 2025 – All rights reserved
iii
ISO/IEC DIS 27017:2025(en)
6 Cloud service specific guidance related to people controls . 14
6.1 Screening .14
6.2 Terms and conditions of employment .
...