Govern the use
- Define requirements and acceptable use
- Assess service and provider risk
- Operate customer-side controls
ISO/IEC 27017:2026 · Cloud security controls
Make shared responsibility visible.
Connect cloud services, customer and provider responsibilities, risks, policies, supplier evidence, technical signals and remediation in one governed operating view.
STORM's supplied technical description lists ISO/IEC 27017 among its supported standards but does not identify the edition. Confirm that assessment content and mappings match the current 2026 edition before relying on them.
Cloud responsibility mapEvidence connected
Sharedassigned & evidenced
Govern the service
- Communicate control responsibilities
- Protect provider-operated capabilities
- Supply assurance and service evidence
PublicPrivateHybrid
2026Current ISO publication
Edition 2Technically revised from 2015
CSC + CSPCustomers and providers
All modelsPublic, private and hybrid cloud
What the standard changes
Apply ISO/IEC 27002 through a cloud lens.
ISO/IEC 27017:2026 adds cloud-specific guidance and controls for organisations that provide or use cloud services. Selection remains driven by risk and applicable legal, regulatory, contractual and cloud-specific requirements.
Clarify the boundary
Record which safeguards belong to the customer, the provider or both so responsibility gaps become reviewable.
See the cloud estate
Identify relevant services, data, dependencies, users, providers and deployment models before evaluating controls.
Select controls by context
Apply cloud guidance according to assessed risk rather than treating every service and relationship as identical.
Align expectations
Connect control ownership and evidence expectations to provider commitments and relevant contractual obligations.
Maintain safeguards
Keep operational control status, security events and remediation visible across organisational boundaries.
Test what is claimed
Review implementation and supporting evidence instead of relying only on generic provider assurances.
Respond to change
Reassess responsibilities and risk when services, architectures, providers or business use materially change.
Connect to the ISMS
Use ISO/IEC 27017 alongside ISO/IEC 27002 guidance and the organisation's wider information-security approach.
Product evidence boundary
Current capability, edition verification and roadmap—kept separate.
The STORM technical description supports strong cloud-governance claims, but it does not establish that every control and automated check has already been updated for ISO/IEC 27017:2026.
Documented as available
- ISO/IEC 27017 listed among supported standards
- Internal and supplier compliance assessments
- Cloud-service, asset, data and provider records
- Risk, policy, audit, evidence and remediation workflows
- Microsoft cloud configuration monitoring through supported integrations
Confirm before claiming
- Assessment content aligned to the 2026 edition
- Exact mappings from checks to ISO/IEC 27017:2026
- Coverage across each customer's cloud services and providers
- Technical enforcement of provider-side controls
- Azure, GCP and AWS infrastructure audit is still marked as roadmap
Where STORM adds operational value
Turn cloud assurance into accountable work.
The platform combines assessments with the assets, providers, risks, policies, evidence and actions that determine whether cloud controls operate beyond a questionnaire.
Evaluate cloud control status
Run internal assessments and supplier questionnaires, record implementation status, identify unanswered controls and maintain remediation progress.
Compliance Assessment · Supplier PortalConnect services and dependencies
Use Cartography to relate business services, data, software, infrastructure, users and providers so cloud scope is grounded in operations.
Cartography · asset modelControl policies and procedures
Maintain cloud-use policies, procedures and governance documents with versions, approvals, reviews, acknowledgements and mappings.
Policy Center · lifecycleTreat provider and service risk
Combine configurable supplier criteria with custom risks, controls, treatment strategies, owners, dates, attachments and mitigation actions.
TPRM · Risk RegistryUse live Microsoft signals
Collect supported configuration data from Microsoft Entra ID, Intune, Defender, Azure, Sentinel and Microsoft 365 to generate applicable evidence.
Microsoft Graph · Security MonitoringKeep review evidence together
Plan internal audits, retain findings, connect corrective actions and bring risk, supplier, incident and compliance inputs into management review.
Audit · actions · management review
Define the cloud scope
Start with the services the business actually depends on.
Build cloud governance on a connected operating model instead of a detached list of provider names. Cartography shows how services, information, software, infrastructure, users and third parties relate.
- Identify cloud-supported business services
- Expose data and technology dependencies
- Connect providers to the processes they support
Assess and close gaps
Move from response status to owned remediation.
STORM documents ISO/IEC 27017 support across compliance, internal-audit and third-party workflows. Assessment results can feed gap actions and custom risks so weaknesses have owners and target dates.
- Internal and supplier assessment workflows
- Implementation status and coverage visibility
- Audit-ready reports and action tracking
Connect technical evidence
Use supported Microsoft configuration signals where they apply.
Security Monitoring continuously validates supported Microsoft cloud configurations and can pre-populate applicable compliance responses. It is evidence input—not proof that every ISO/IEC 27017 responsibility is fulfilled.
- Configuration checks and historical results
- Severity, thresholds and implementation status
- Evidence flow into compliance assessments
Govern provider risk
Keep decisions, controls and follow-through in one record.
Use the Risk Registry and treatment workflow for cloud risks arising from services, control gaps or supplier assessments, while preserving the reason, selected response and supporting evidence.
- Likelihood, impact and treatment strategy
- Controls, owners, review dates and attachments
- Mitigation actions and exportable records
Practical evaluation themes01 02 03 04 05 06 07 08
Review the joins where cloud responsibility can split.
These themes help organise a review; they do not reproduce or replace the licensed ISO/IEC 27017:2026 control text.
Responsibility model
Identify who implements, operates, monitors and evidences each relevant safeguard.
Customer · provider · sharedCloud inventory
Maintain the services, deployment models, data, interfaces, users and supporting dependencies in scope.
Scope · assets · relationshipsProvider assurance
Evaluate provider evidence and contractual commitments against the organisation's actual risk and requirements.
Due diligence · evidenceIdentity & access
Review the customer and provider activities that protect privileged and ordinary access to cloud capabilities.
Roles · access · oversightConfiguration & change
Track approved settings, technical checks, exceptions and changes that can affect the control boundary.
Baseline · monitoring · changeEvents & incidents
Make detection, communication, response ownership and corrective actions clear across the relationship.
Signals · escalation · responseData & continuity
Connect information handling, resilience expectations and recovery dependencies to accountable controls.
Protection · recovery · evidenceExit & improvement
Review residual risk, remediation and service transitions as cloud use and providers change.
Action · transition · reviewUse the licensed standard and qualified interpretation to determine exact applicability. STORM supports the governance workflow; technical and contractual controls remain the responsibility of the relevant customer and provider teams.
A working cloud assurance cycle01 02 03 04 05
From service inventory to defensible evidence.
A useful assessment connects every response to scope, ownership, risk, evidence and action.
Discover
Identify services, data, providers, deployment models and business dependencies.
Cartography · scopeAssign
Clarify customer, provider and shared control responsibilities.
Ownership · agreementAssess
Evaluate implementation and risk using the confirmed 2026 requirement set.
Controls · risk · evidenceOperate
Monitor supported signals and manage gaps, risks and supplier remediation.
Checks · actions · datesAssure
Audit evidence, review changes and retain management decisions.
Audit · review · improvePractical questions
Know exactly what is supported—and what still needs verification.
The strongest implementation separates standard guidance, product workflow, technical control operation and independent assurance.
Does STORM include ISO/IEC 27017 assessments?
The supplied technical description lists ISO/IEC 27017 among the standards supported by STORM and explicitly references internal audits and third-party assessments against it. Because the document does not identify an edition, confirm that the deployed questionnaires and mappings have been updated to ISO/IEC 27017:2026.
Does ISO/IEC 27017 apply only to public cloud?
No. ISO states that the 2026 edition applies across public, private and hybrid deployment models. Private-cloud implementations may require adaptation to reflect responsibilities and capabilities across internal organisational units.
Is ISO/IEC 27017 only for cloud providers?
No. It provides controls and implementation guidance for both cloud service customers and cloud service providers, helping each side understand and manage its part of the security relationship.
Does STORM automatically audit Azure, AWS and GCP infrastructure?
Not as a current general capability in the supplied description. STORM currently documents Microsoft configuration monitoring through Graph API integrations. A broader Cloud Infrastructure Audit for Azure, GCP and AWS is identified as a Q4 2026 roadmap item, so it must not be represented as delivered until confirmed.
How does ISO/IEC 27017 differ from ISO/IEC 27018?
ISO/IEC 27017 addresses information-security controls for providing and using cloud services across deployment models. ISO/IEC 27018:2025 is focused on protecting personally identifiable information in public clouds when the provider acts as a PII processor.
Does using STORM guarantee conformity or certification?
No. STORM can support assessments, records, evidence and remediation, but conformity depends on the organisation's implemented controls and applicable scope. Any assurance or certification decision must follow the relevant scheme and be made by an appropriately competent independent body.
Does STORM's own Azure hosting prove a customer's ISO/IEC 27017 implementation?
No. STORM's hosting and security arrangements are relevant supplier evidence, but they do not establish that a customer's complete cloud estate, responsibilities and controls conform to ISO/IEC 27017.
Bring your cloud responsibility model
Book a STORM demo Test STORM against the cloud controls your organisation must actually operate.
Review your services, providers, shared responsibilities, assessment edition, Microsoft evidence sources, risk method and remediation workflow in a focused STORM walkthrough.