Alert

ISO/IEC 27017:2026 is the latest international standard providing information security controls and implementation guidance specifically for cloud services. Published in July 2026, the new edition replaces ISO/IEC 27017:2015 and aligns the standard with the updated control framework in ISO/IEC 27002:2022.

ISO/IEC 27017 is designed for both cloud service providers (CSPs) and cloud service customers (CSCs). It supplements the information security controls in ISO/IEC 27002 with cloud-specific implementation guidance and additional controls addressing risks and responsibilities unique to cloud environments.

The 2026 edition represents a technical revision of the previous standard. Its structure has been updated to align with ISO/IEC 27002:2022, including its organizational, people, physical, and technological control themes. Controls from the previous edition have also been merged, removed, or revised, and new cloud-specific controls have been introduced.

What’s New in ISO/IEC 27017:2026?

One of the most significant changes in the 2026 edition is the introduction of two new cloud-specific controls.

Control 5.39: Agreement on Roles and Responsibilities of the Cloud Service Partner

This new control addresses the need to establish and agree upon information security roles and responsibilities involving cloud service partners. Organizations should consider how security responsibilities are allocated not only between CSCs and CSPs, but also across other parties involved in the delivery of cloud services.

Control 8.36: Detection and Prevention of Unauthorized Use of Cloud Services

This new control addresses the risks associated with unauthorized cloud service use. Organizations should establish appropriate measures to identify and prevent the use of cloud services that have not been authorized, helping address risks associated with unmanaged or “shadow” cloud services.

In addition to these two new controls, ISO/IEC 27017:2026 retains two dedicated cloud-specific control areas from the previous edition under the updated ISO/IEC 27002:2022 structure:

• Control 5.38: Shared roles and responsibilities within a cloud computing environment
• Control 8.35: Segregation in virtual computing environments

Organizations transitioning from ISO/IEC 27017:2015 should pay particular attention to Controls 5.39 and 8.36 during their gap analysis because these requirements didn’t have equivalent dedicated controls in the previous edition.

Why Adopt this Update?

Adopting ISO/IEC 27017:2026 helps organizations maintain cloud security practices that are aligned with the current ISO/IEC 27001 and ISO/IEC 27002 framework.

For organizations providing cloud services, the standard can help establish clear security responsibilities between the provider, its customers, and other parties involved in delivering cloud services. For organizations consuming cloud services, it provides guidance for understanding and managing security responsibilities that may be shared with cloud providers and other cloud service partners.

The addition of controls addressing cloud service partners and unauthorized cloud service use also reflects the increasingly complex nature of modern cloud environments, where multiple providers, platforms, and services may be involved in delivering or supporting business operations.

Prepare for a Smooth Transition

If your organization currently uses ISO/IEC 27017:2015 as part of its information security management system (ISMS) or certification program, you should begin planning your transition to the 2026 edition.

1. Conduct a Gap Analysis

Compare your existing cloud security controls and practices against ISO/IEC 27017:2026. Annex A of the new standard provides a correspondence between the 2026 controls and the previous edition and can help organizations identify where controls have moved, changed, or been incorporated into other guidance.

As part of this review, organizations should specifically evaluate their practices against the two net-new controls, 5.39 and 8.36, and determine whether additional controls, documentation, or evidence are necessary.

2. Update Policies, Procedures, and Controls

Based on the gap analysis, update applicable policies, procedures, and cloud security controls to address identified gaps. Organizations should also review their risk assessments, Statement of Applicability (SoA), cloud service agreements, shared responsibility documentation, and other ISMS documentation that references ISO/IEC 27017:2015.

Because the 2026 edition is aligned with ISO/IEC 27002:2022, organizations should also verify that references and control mappings reflect the current ISO/IEC 27001:2022 and ISO/IEC 27002:2022 control structure.

3. Address the New Cloud-Specific Controls

Organizations should determine how the two new controls apply within their cloud environment.

For Control 5.39, this may include identifying cloud service partners involved in service delivery, documenting their respective information security responsibilities, and ensuring those responsibilities are appropriately addressed through agreements or other governance mechanisms.

For Control 8.36, organizations should evaluate how unauthorized cloud services are identified and controlled. This may include reviewing cloud governance processes, acceptable-use requirements, technical monitoring capabilities, and processes for approving or restricting cloud services.

4. Work with Your Certification Body

Organizations that incorporate ISO/IEC 27017 into an ISO/IEC 27001 certification program should communicate with their certification body regarding expectations for adopting the 2026 edition.

Your certification body can provide information about how the revised standard will be addressed during future certification and surveillance activities and help you understand what evidence may be needed to demonstrate that applicable changes have been implemented.

Taking these steps now can help your organization make an orderly transition from ISO/IEC 27017:2015 while maintaining effective cloud security practices.

We’re Here to Help

For more information on transitioning to ISO/IEC 27017:2026 or maintaining your ISMS operation, contact your Baker Tilly professional.