Compliance tools · Cybersecurity and data protection

Toolkit for ISO 27017

ISO/IEC 27017:2026 · European Union and United Kingdom · Voluntary standard

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your Toolkit for ISO 27017 documentation cited clause by clause. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

Toolkit for ISO 27017 is ISO/IEC 27017:2026, a voluntary standard in the European Union and United Kingdom. Cloud-specific information security controls. The toolkit runs alongside your own licensed copy of the ISO standard.

The free assessment screens for Toolkit for ISO 27017 when a business makes or supplies products or services with digital elements, or operates online or provides digital services.

Sectors this instrument reaches: cloud services; SaaS; IT and technology; managed services; hosting.

This is a voluntary standard rather than binding law. Businesses adopt it because customers, insurers or public buyers ask for it.

Screen your business against all 116 agent toolkits, free →

• Your exact position under Toolkit for ISO 27017: what is in place, what is missing, and what to do about each gap.
• Documentation with clause citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the standard requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that Toolkit for ISO 27017 applies to your business, free →

Does Toolkit for ISO 27017 apply to my business?

ISO/IEC 27017 applies to you if you provide or use cloud computing services, as a cloud service provider or a cloud service customer, in any sector and at any size. It covers IaaS, PaaS and SaaS across public, private, community and hybrid deployment models. Adoption is voluntary, so no law forces it on you.

Who does ISO 27017 apply to?

It applies to cloud service providers (CSPs) and cloud service customers (CSCs) of all sizes and sectors that provide or use cloud computing services. It also applies to any organisation seeking information security controls specific to cloud environments. The standard imposes no duties on governments or regulators.

Does Toolkit for ISO 27017 apply to a small business?

The instrument has no size threshold. ISO/IEC 27017:2015 applies to cloud service providers and cloud service customers of all sizes and sectors, and it is highly relevant to SMEs using or providing cloud services. No exemption or relief by employee count or turnover is stated.

When does ISO 27017 apply from, and what are the deadlines?

ISO/IEC 27017 does not impose statutory reporting deadlines; it operates within the ISO 27001 certification and review cycle. Internal audits are due at planned intervals under ISO/IEC 27001 Clause 9.2 and management reviews under Clause 9.3. Surveillance audits fall at roughly 12 and 24 months, with recertification every three years.

What does ISO 27017 require me to do?

You must operate cloud-specific controls within an ISO 27001 ISMS, covering shared responsibility documentation (CLD.6.3.1), cloud asset inventory (Clause 8.1.1), encryption and key management (Clauses 10.1.1 and 10.1.2), logging (Clauses 12.4.1 to 12.4.4), incident notification (Clauses 16.1.1 and 16.1.2) and business continuity (Clause 17.1). Top management must also set policy (Clause 5.2) and assign roles (Clause 5.3).

What records or documents does ISO 27017 require me to keep or produce?

You must keep documented information control records, internal audit records, a cloud asset inventory and CSP operational procedures documentation, which form the four record keeping obligations. Evidence also includes board-level approval records, leadership review minutes, a RACI matrix for cloud security controls, and the Statement of Applicability for the CLD controls.

What happens if I do not comply with ISO 27017?

ISO is not a regulator and imposes no fines. A minor nonconformity requires corrective action, typically within 90 days, while a major nonconformity can stop the certificate being issued or continued, with resolution typically within six months. Unresolved major nonconformities can lead to suspension and then withdrawal of the certificate.

How is ISO 27017 different from ISO 27018?

ISO/IEC 27018:2019 extends ISO 27017 specifically to protection of personally identifiable information in public cloud. ISO 27017 addresses information security broadly, while ISO 27018 adds PII-specific processing controls, consent handling and data subject rights support. Organisations processing personal data in cloud should apply both standards together.

How do I start complying with ISO 27017?

The first practical step is to understand your context in relation to cloud services under ISO/IEC 27001 Clause 4.1 and identify interested parties with cloud-specific security requirements under Clause 4.2.

Which ComplianceSME account includes the Toolkit for ISO 27017 toolkit?

The Toolkit for ISO 27017 agent toolkit is included in Compliance Complete.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive