Relationship to ISO 27001 and 27002

Overview

ISO 27017 does not exist in isolation. It is designed to work in conjunction with ISO 27001 (Information Security Management Systems) and ISO 27002 (Code of Practice for Information Security Controls). Understanding these relationships is crucial for effective implementation and potential certification.

Learning Objectives

By the end of this lesson, you will be able to:

• Understand how ISO 27017 relates to ISO 27001 and 27002
• Map ISO 27017 controls to ISO 27002 controls
• Integrate ISO 27017 into an ISO 27001 ISMS
• Understand certification possibilities with ISO 27017
• Plan an integrated implementation approach
• Leverage existing ISO 27001/27002 implementations for cloud security

The ISO 27000 Family

Standards Hierarchy

┌──────────────────────────────────────────────┐
│   ISO/IEC 27000 - Vocabulary and Definitions │
└──────────────┬───────────────────────────────┘
               │
      ┌────────┴────────┐
      │                 │
┌─────▼─────────┐  ┌───▼────────────────────┐
│ ISO/IEC 27001 │  │  ISO/IEC 27002         │
│ ISMS Reqts    │  │  Security Controls     │
│ (Certifiable) │  │  (Code of Practice)    │
└─────┬─────────┘  └───┬────────────────────┘
      │                │
      │    ┌───────────┴────────────┐
      │    │                        │
┌─────▼────▼──────┐         ┌──────▼─────────────┐
│ ISO/IEC 27017   │         │ Other sector-      │
│ Cloud Security  │         │ specific standards │
│ Code of Practice│         │ (27018, 27701...)  │
└─────────────────┘         └────────────────────┘

Overview of Related Standards

ISO 27001: The Management System

What is ISO 27001?

ISO 27001 is the international standard for Information Security Management Systems (ISMS). It specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS.

Key Components of ISO 27001

1. Context of the Organization (Clause 4)

• Understanding the organization and its context
• Understanding needs and expectations of interested parties
• Determining scope of the ISMS
• Establishing the ISMS

2. Leadership (Clause 5)

• Management commitment
• Information security policy
• Organizational roles, responsibilities, and authorities

3. Planning (Clause 6)

• Risk assessment and treatment
• Information security objectives and planning

4. Support (Clause 7)

• Resources
• Competence
• Awareness
• Communication
• Documented information

5. Operation (Clause 8)

• Operational planning and control
• Information security risk assessment
• Information security risk treatment

6. Performance Evaluation (Clause 9)

• Monitoring, measurement, analysis, and evaluation
• Internal audit
• Management review

7. Improvement (Clause 10)

• Nonconformity and corrective action
• Continual improvement

ISO 27001 Annex A Controls

ISO 27001 Annex A lists 93 controls organized into 4 themes (2022 version):

Note: The 2022 version restructured controls from the previous 14 domains to 4 themes.

ISO 27002: The Code of Practice

What is ISO 27002?

ISO 27002 provides detailed guidance on implementing the controls listed in ISO 27001 Annex A. It is a best practice guide, not a certifiable standard.

ISO 27002 Structure (2022)

Each control in ISO 27002 includes:

1. Control: What needs to be implemented
2. Purpose: Why the control is important
3. Guidance: How to implement the control
4. Other Information: Additional context and considerations

Example ISO 27002 Control

A.8.1 - User endpoint devices

Control Type: Technological Control: Information stored on, processed by or accessible via user endpoint devices shall be protected.

Purpose: To prevent unauthorized disclosure, modification, removal or destruction of information stored on user endpoint devices.

Guidance: Includes protection of:

• Laptops, tablets, mobile phones
• Removable media
• Information in transit
• Remote working scenarios

ISO 27017: Cloud-Specific Guidance

What is ISO 27017?

ISO 27017 is a code of practice that:

1. Provides additional implementation guidance for relevant ISO 27002 controls when applied to cloud services
2. Introduces new cloud-specific controls not covered in ISO 27002

Structure of ISO 27017

ISO 27017 controls are categorized as:

Type 1: Cloud-Enhanced Controls

• Controls from ISO 27002 with additional cloud-specific implementation guidance
• Designated with original control number (e.g., A.9.4.1)

Type 2: Cloud-Specific Controls

• New controls unique to cloud computing
• Designated with "CLD" prefix (e.g., CLD.6.3.1)

Cloud-Specific Controls in ISO 27017

Relationship Mapping

How ISO 27017 Extends ISO 27002

Example 1: Access Control

ISO 27002 Control A.9.4.1 - Information Access Restriction

• General: Restrict access to information and application system functions

ISO 27017 Additional Guidance for Cloud:

• For CSPs: Implement mechanisms to isolate customer data and processing
• For CSCs: Configure access controls appropriately within cloud services
• Cloud-specific considerations: Multi-tenancy, virtualized environments, APIs

Example 2: Cryptography

ISO 27002 Control A.10.1.1 - Policy on Use of Cryptographic Controls

• General: Develop and implement policy on cryptographic controls

ISO 27017 Additional Guidance for Cloud:

• For CSPs:
  • Provide encryption capabilities
  • Support customer-managed encryption keys
  • Ensure encryption doesn't compromise isolation
• For CSCs:
  • Understand what data is encrypted by provider
  • Implement additional encryption where needed
  • Manage encryption keys appropriately

Control Mapping Matrix

Complete Mapping Example

ISO 27002 Domain: Access Control

Integration with ISO 27001 ISMS

Approach 1: Cloud-Enhanced ISMS

For organizations with existing ISO 27001 certification adding cloud services:

Step 1: Scope Expansion

• Review current ISMS scope
• Add cloud services to scope
• Identify cloud-specific risks

Step 2: Risk Assessment Update

• Assess cloud-specific risks
• Apply ISO 27017 guidance
• Update risk treatment plan

Step 3: Control Enhancement

• Review existing Annex A controls
• Apply ISO 27017 cloud guidance
• Implement cloud-specific controls where applicable

Step 4: Documentation Update

• Update information security policy
• Enhance procedures for cloud
• Document cloud-specific controls

Step 5: Certification Maintenance

• Surveillance audit includes cloud scope
• Demonstrate ISO 27017 implementation
• Maintain combined certification

Approach 2: Cloud-First ISMS

For organizations implementing ISO 27001 primarily for cloud:

Step 1: ISMS Framework

• Establish ISMS according to ISO 27001
• Define scope including cloud services
• Establish context of organization

Step 2: Integrated Risk Assessment

• Conduct risk assessment with cloud focus
• Use ISO 27017 as primary control reference
• Consider ISO 27002 for non-cloud aspects

Step 3: Statement of Applicability (SOA)

• Select Annex A controls
• Apply ISO 27017 guidance
• Justify exclusions

Step 4: Implementation

• Implement controls per ISO 27017
• Document cloud-specific procedures
• Train personnel on cloud security

Step 5: Certification

• Pursue ISO 27001 certification
• Reference ISO 27017 implementation
• Demonstrate cloud control effectiveness

ISMS Documentation for Cloud

Required ISO 27001 Documents with Cloud Considerations:

Certification Considerations

ISO 27001 Certification with ISO 27017

Current Practice:

• ISO 27017 is not independently certifiable
• Organizations get ISO 27001 certification
• Can reference ISO 27017 compliance in scope

Certification Statement Example:

"XYZ Corporation has achieved ISO/IEC 27001:2022
certification for its Information Security Management
System, with cloud security controls implemented in
accordance with ISO/IEC 27017:2015."

Scope: Provision of cloud-based customer relationship
management (CRM) services.

Audit Approach

Stage 1 Audit (Documentation Review):

• Review ISMS documentation
• Verify ISO 27017 controls in SOA
• Assess cloud risk assessment
• Review cloud-specific procedures

Stage 2 Audit (Implementation Assessment):

• Verify control implementation
• Test cloud-specific controls
• Review cloud provider agreements
• Assess monitoring effectiveness
• Interview cloud security personnel

Surveillance Audits:

• Ongoing compliance verification
• Cloud security incident reviews
• Changes to cloud services
• SOA updates for new cloud controls

Benefits of Combined Certification

Implementation Roadmap

Phase 1: Assessment (Months 1-2)

If No Existing ISMS:

• Conduct gap analysis against ISO 27001
• Assess cloud services in scope
• Identify applicable ISO 27017 controls
• Assess current security maturity
• Define ISMS scope

If Existing ISO 27001:

• Review current ISMS scope
• Identify cloud services to add
• Gap analysis for ISO 27017
• Update risk assessment for cloud

Phase 2: Planning (Month 3)

• Define information security policy updates
• Conduct cloud risk assessment
• Develop risk treatment plan
• Create Statement of Applicability (ISO 27017 controls)
• Define roles and responsibilities
• Develop implementation project plan
• Secure budget and resources

Phase 3: Implementation (Months 4-9)

ISMS Foundation (if new):

• Establish ISMS framework
• Develop core policies and procedures
• Implement basic controls

Cloud-Specific Implementation:

• Implement ISO 27017 cloud controls
• Update cloud provider agreements
• Deploy cloud security tools (CASB, CSPM, etc.)
• Implement monitoring and logging
• Conduct security awareness training
• Document procedures and work instructions

Phase 4: Validation (Months 10-11)

• Internal audit of ISMS
• Test cloud security controls
• Review incident response procedures
• Management review
• Address nonconformities
• Update documentation

Phase 5: Certification (Month 12)

• Select certification body
• Schedule Stage 1 audit
• Address Stage 1 findings
• Schedule Stage 2 audit
• Address Stage 2 findings
• Achieve certification
• Plan surveillance audits

Ongoing: Maintenance and Improvement

• Quarterly management reviews
• Continuous monitoring
• Regular risk assessments
• Annual internal audits
• Surveillance audits (typically annual)
• Continual improvement initiatives

Practical Example: Integrated Implementation

Scenario: SaaS Provider Implementing ISO 27001 with ISO 27017

Company: CloudCRM Inc., providing cloud-based CRM services Goal: ISO 27001 certification with ISO 27017 implementation

Step 1: Define Scope

ISMS Scope:
"The provision, development, and support of cloud-based
customer relationship management software delivered as
a service (SaaS) to enterprise customers."

Includes:
- Application development and maintenance
- Cloud infrastructure (AWS)
- Customer data processing
- Customer support operations

Excludes:
- Corporate IT (office networks, endpoints)
- Marketing operations

Step 2: Risk Assessment

Sample risks identified:

Step 3: Statement of Applicability

Excerpt from SOA:

Step 4: Implementation Highlights

Cloud-Specific Controls Implemented:

• Virtual machine hardening (CLD.6.3.1) - Minimal OS images, automated patching
• Cloud service monitoring (CLD.9.5.1) - Real-time dashboards, automated alerts
• Virtual network protection (CLD.9.5.2) - VPC isolation, security groups, NACLs

ISO 27002 Controls with Cloud Enhancement:

• A.12.1.3 (Capacity management) - Auto-scaling policies, capacity alerts
• A.13.1.1 (Network controls) - Cloud-native firewall, WAF
• A.16.1.1 (Incident response) - Integration with AWS security findings

Step 5: Audit and Certification

Stage 1 Findings:

• Minor: Incident response plan didn't include CSP notification procedures
• Minor: Cloud asset inventory incomplete

Corrective Actions:

• Updated incident response plan with AWS notification process
• Implemented automated cloud asset discovery tool

Stage 2 Result:

• Certification achieved
• Certificate scope references ISO 27017 implementation

Control Mapping Reference Table

Sample ISO 27002 to ISO 27017 Mapping

Key Takeaways

1. ISO 27017 extends ISO 27002 with cloud-specific guidance and new controls

2. ISO 27001 provides the ISMS framework within which ISO 27017 controls are implemented

3. ISO 27017 is not independently certifiable but can be referenced in ISO 27001 certification

4. Integration is straightforward - ISO 27017 controls map directly to ISO 27001 Annex A structure

5. Existing ISO 27001 organizations can expand scope to include cloud with ISO 27017 guidance

6. Cloud-first organizations can implement ISO 27001 using ISO 27017 as primary control reference

7. Documentation must reflect cloud aspects - policies, procedures, and SOA should reference ISO 27017

8. Certification audits will assess both ISO 27001 requirements and ISO 27017 control implementation

9. Implementation can be phased - start with high-risk areas and expand coverage

10. The standards work together - ISO 27001 (what), ISO 27002 (how), ISO 27017 (cloud-specific how)

Preparation for Next Lesson

In the next lesson, Module Assessment, you will:

• Test your understanding of Module 1 concepts
• Apply knowledge to practical scenarios
• Prepare for Module 2 on Cloud Service Provider Controls

Self-Assessment Questions

1. What is the relationship between ISO 27001 and ISO 27017?
2. Can an organization get ISO 27017 certification without ISO 27001?
3. How does ISO 27017 enhance ISO 27002 controls?
4. What are the two types of controls in ISO 27017?
5. How many cloud-specific controls (CLD prefix) does ISO 27017 introduce?
6. What is a Statement of Applicability (SOA)?
7. How should cloud services be reflected in the ISMS scope?
8. What is the difference between ISO 27002 and ISO 27017?
9. How often are surveillance audits typically conducted?
10. What are the main phases of implementing an integrated ISO 27001/27017 ISMS?

Practical Exercise

Exercise: Create a Statement of Applicability Extract

Scenario: You are implementing ISO 27001 for a company that uses:

• AWS IaaS for application hosting
• Microsoft 365 for productivity
• Salesforce for CRM

Task: Create an SOA extract for the Access Control domain that includes:

1. Applicable ISO 27002 controls
2. How ISO 27017 guidance is applied
3. Implementation description for each
4. Justification for any exclusions

Format:

This lesson has demonstrated how ISO 27017 integrates with ISO 27001 and 27002 to provide a comprehensive framework for cloud security. The next lesson will test your understanding of all Module 1 concepts.