Cloud Service Controls Template (ISO/IEC 27017:2026)

Cloud Service Controls (ISO/IEC 27017): [Organization name]

Records how [Organization name] applies cloud-specific information security controls as a cloud service customer, a cloud service provider, or both: role determination, a shared responsibility matrix per control area, a customer and provider implementation table, the additional cloud controls, provider disclosures and cloud service monitoring. It supports ISO/IEC 27001:2022 + Amd 1:2024 (6.1.3 and Annex A, in particular A.5.19 to A.5.23) using the guidance of ISO/IEC 27017:2026, the new edition that replaced the 2015 edition, and ISO/IEC 27002:2022. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

• 1. Purpose, scope and role determination
• 2. About ISO/IEC 27017:2026
• 3. Cloud services and parties in scope
• 4. Shared responsibility matrix by control area
• 5. Implementation table
• 6. Additional cloud-specific controls
• 7. Provider disclosures to customers
• 8. Cloud service monitoring
• 9. Statement of Applicability and risk integration
• 10. Assurance, attestation and certification
• 11. Size tiers
• 12. Records and evidence
• 13. References
• Standard and licence note

1. Purpose, scope and role determination

This document shows how [Organization name] implements information security controls for cloud services within the ISMS scope (DOC-ISMS-002). It applies the cloud services security policy (DOC-ISMS-044) at control level and records the responsibilities split between the organization and each cloud provider or cloud customer.

Two roles are possible. As a cloud service customer, the organization uses services provided by others and remains accountable for its own information, identities and configuration. As a cloud service provider, the organization delivers a service to its own customers and must both protect that service and tell customers enough for them to meet their own obligations. Many organizations hold both roles at once. Suppliers that support either party (for example a managed service provider operating a tenant, or an auditor of the cloud service) are treated as cloud service partners and handled through the supplier process (DOC-ISMS-066, DOC-ISMS-068).

2. About ISO/IEC 27017:2026

ISO/IEC 27017 is a guidance standard: it gives guidance, not management system requirements. It supplements ISO/IEC 27002 with cloud-specific implementation guidance for both customers and providers, and adds a small number of cloud-specific controls. Facts relied on in this template:

Organizations that implemented the 2015 edition should run a short transition: map each old entry (including the extended controls with the CLD prefix) to the 2026 structure using the mapping annex, update the SoA extension table (section 9), and tell customers who receive provider disclosures that the reference has changed. Record the transition in the ISMS change plan (DOC-ISMS-025) if it changes scope, contracts or customer commitments.

3. Cloud services and parties in scope

Parties and partners relevant to cloud security:

4. Shared responsibility matrix by control area

Legend: C customer, P provider, S shared (both parties hold duties, detailed in section 5). The table shows the organization's default view; record differences per service in section 3.

5. Implementation table

Columns: Customer side is what the organization does when it consumes a cloud service. Provider side is what the organization does when it delivers its own cloud service. Evidence names the record an auditor can sample. Control labels are short descriptions, not the official titles.

5.1 Organizational controls

5.2 People and physical controls

5.3 Technological controls

6. Additional cloud-specific controls

Published summaries of ISO/IEC 27017:2026 (at least two independent secondary sources as of 2026-11-01) report four additional cloud-specific controls, numbered after the last ISO/IEC 27002:2022 control in each theme. One summary describes 8.36 as mainly a customer concern. Use the mapping annex of the 2026 edition to see which 2015 extended controls (CLD prefix) each one replaces. Treat the numbering as provisional until checked against the standard.

If your copy of the standard shows a different set, update this table, section 9 and the SoA extension at the same time.

7. Provider disclosures to customers

As a provider, the organization keeps the following information current and makes it available to customers under the stated channel.

Incident notification between the provider and its customers follows the sequence below. The same pattern applies in reverse when the organization is the customer of an upstream provider.

8. Cloud service monitoring

9. Statement of Applicability and risk integration

1. Keep the Annex A rows in the SoA (DOC-ISMS-011) as the master list. For controls with a cloud angle, reference the CLC rows in section 5 in the SoA "where implemented" column.
2. Add an extension table to the SoA for the additional controls in section 6, with inclusion decision, justification and status, exactly as for Annex A controls.
3. Link each cloud risk in the risk register (DOC-ISMS-016) to the CLC or CLX rows that treat it. Typical cloud risks: tenant misconfiguration, provider outage in one region, compromised administrator credentials, unclear deletion at exit, unexpected data location change, and concentration on one provider.
4. When a control is shared (S in section 4), the risk owner checks both halves: the organization's own implementation and the evidence that the other party performs its part (assurance report, contract clause, test).

10. Assurance, attestation and certification

• ISO/IEC 27017 contains guidance and controls, not management system requirements, so it is not certified on its own. Some certification bodies assess the cloud controls as part of an ISO/IEC 27001 audit and state this in the certificate scope, an annex or a separate statement. The certification body decides what it can verify and how it records it; ask before you plan the audit (DOC-ISMS-090).
• Customer assurance depends on the scope: check that the certificate scope names the cloud service, and that any reference to ISO/IEC 27017 names the 2026 edition once your audit has covered it.
• As a customer, accept provider statements of alignment only with evidence: certificate scope, assurance report, or contractual commitment, reviewed under DOC-ISMS-067.
• Cloud-related questionnaires (for example the CSA Cloud Controls Matrix and CAIQ, cited by name only) can be answered from sections 5 to 8. Map them in isms/control-framework-crosswalk.

11. Size tiers

12. Records and evidence

Link each record to its controls in isms/control-evidence-matrix.

13. References

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (6.1.3 and Annex A controls A.5.19 to A.5.23), ISO/IEC 27002:2022 and ISO/IEC 27017:2026. Control numbers are cited with original short labels; the matrices, tables, examples and guidance are original text, and no text from ISO/IEC standards is reproduced. Details of the 2026 edition of ISO/IEC 27017 (additional control numbers and annexes) are taken from the ISO catalogue entry and published summaries and must be checked against the official text. Obtain the official standards from ISO, IEC or your national standards body to implement them. The CSA Cloud Controls Matrix and CAIQ are cited by name only. Check the current edition of each standard before use.

Template licence: MIT.