Core Controls in ISO27017
Cloud Security Controls
Speak to a GRC expert
If you have any questions or need assistance, please don't hesitate to contact us.
Email: [email protected]WhatsApp: +123 456 7890
Share on social media
Shared Responsibilities in Cloud Security
In ISO/IEC 27017, the control on Shared Responsibilities emphasizes the need to clearly define and document which security tasks are handled by the cloud service provider and which by the customer.
These responsibilities should be explicitly stated in contracts or service-level agreements (SLAs) to avoid confusion or security gaps.
Both parties must understand, accept, and regularly review their roles. This ensures accountability and strengthens overall cloud security management.
The core controls in ISO/IEC 27017 related to virtual protections
- Clearly define roles between cloud provider and customer
- Avoid assumptions that lead to security gaps
- Include these details in SLAs and agreements
- Ensure mutual understanding of obligations
- Protect virtual machines from unauthorized access
- Ensure secure provisioning, management, and decommissioning
- Use hardened images and limit unnecessary services
- Apply regular updates and monitor for compromise
- Data stored in the cloud must be isolated and secured
- Implement encryption for data at rest and in transit
- Restrict access using identity and access controls
- Ensure backup and recovery measures are in place
- Use segmentation to limit exposure and control traffic
- Apply firewalls, intrusion detection, and secure gateways
- Monitor traffic for suspicious behavior continuously
- Define clear network architecture and trust zones
- Ensure secure admin access to cloud resources
- Use multi-factor authentication and logging
- Limit privileges based on the principle of least privilege
- Regularly audit and review administrative actions
Core ISO/IEC 27017 Controls for Cloud Security
Key focus areas to guide secure cloud service implementation and management.
- Define Shared Roles
- Process Asset Returns
- Isolate Virtual Systems
- Manage VM Settings
- Enforce VM Hardening
- Control Admin Access
- Monitor User Activity
- Align Security Tasks
- Protect Network Layer
- Delete Data Securely
Continue Reading
Ready to learn more about ISO27017 Implementation Guide?