ISO/IEC 27017 Information Security Controls Based on ISO/IEC 27002 for Cloud Services

What this entry covers

ISO/IEC 27017, published jointly by ISO and IEC, gives guidance on information security controls for cloud services. It adds cloud-specific guidance to controls in ISO/IEC 27002 and defines additional cloud controls, for both cloud service providers and cloud service customers. The current edition is ISO/IEC 27017:2026.

MyRHC indexes this framework so practitioners, auditors, and automated agents can find the authoritative primary sources in one place. This page is a navigation aid. It is not legal advice and is not a substitute for the official text.

Official documentation

• Primary official source: https://www.iso.org/standard/27017
• IEC webstore listing: https://webstore.iec.ch/en/publication/115400

Recent changes

• 2026-07-27: ISO/IEC 27017:2026 (edition 2.0) was published, with guidance for cloud services based on the controls in ISO/IEC 27002:2022. ISO; IEC

How to use this index entry

1. Open the official link above (or the agency home if the deep link drifts).
2. Confirm edition / revision date against your program scope.
3. Map applicability by sector and jurisdiction listed in the metadata.
4. Follow related frameworks only after checking their own official sources.

Disclaimers

• MyRHC does not host proprietary standards text (ISO, some industry bodies).
• Where standards are paywalled, we link to the publisher’s catalog page.
• Always verify current requirements with counsel and the issuing authority.