ISO/IEC 27001 and ISO/IEC 27017

ISO/IEC 27001 is the internationally recognized standard for an Information Security Management System (ISMS). Certification is issued by an accredited certification body and shows customers worldwide that you manage information security risk systematically. ISO/IEC 27017 extends that program with security controls specific to cloud services.

ISO/IEC 27001:2022

• Management system requirements (Clauses 4 to 10): context, leadership, risk assessment and treatment, support, operation, performance evaluation, and continual improvement.

• Annex A controls: 93 controls in four themes: organizational, people, physical, and technological. Your Statement of Applicability documents which apply and why.

• 2022 transition: certificates issued against the older 2013 edition had to transition to the 2022 edition by October 31, 2025.

ISO/IEC 27017:2015 for Cloud Services

ISO/IEC 27017 provides cloud-specific implementation guidance for ISO/IEC 27002 controls, plus additional controls covering shared responsibilities between cloud service providers and cloud customers, virtual machine hardening, tenant segregation, and administrator operations. It is typically assessed as an extension of your ISO/IEC 27001 certification scope.

The Certification Cycle

• Stage 1 audit: documentation and readiness review.

• Stage 2 audit: evidence that the ISMS and controls are implemented and operating.

• Surveillance audits: annually in years two and three.

• Recertification: a full audit every three years.

How We Get You There

• ISMS scoping, risk assessment methodology, and Statement of Applicability.

• Gap assessment against ISO/IEC 27001 Annex A and ISO/IEC 27017 cloud controls.

• Policies, procedures, internal audit, and management review.

• Certification body selection and audit support.

• Ongoing vCISO oversight for surveillance audits.

Resources

• ISO: ISO/IEC 27001:2022 Information security management systems

• ISO: ISO/IEC 27002:2022 Information security controls

• ISO: ISO/IEC 27017:2015 Security controls for cloud services

• Cloud Security Alliance: STAR Registry

• Related: SOC 2 and HITRUST

Ready to Start?

Tell us about your scope and timeline and we will send a scoped proposal for ISO/IEC 27001 and 27017 readiness. Request a quote.

ISO certificates are issued only by accredited certification bodies. Temple of Epiphany provides readiness, implementation, and advisory services and does not issue certificates.