#60 What is ISO 27017

Steve Mason is a Senior Consultant at Blackmores (UK) Ltd, and has a 100% success rate of supporting clients in achieving their ISO 9001 & ISO 27001 certifications on their first time.

With over 38 years of experience working with standards, Steve is incredibly knowledgeable about how to ensure companies get the best benefits when implementing new standards. Steve has never stopped advancing himself and continues to broaden his knowledge of new standards as they come into existence.

Today, Steve is back to discuss the new ISO 27017 (Information Security Controls for Cloud Services Standard), and why it is needed in addition to ISO 27001.

The current publication of ISO 27001 was released back in 2013 before cloud security was as big of a concern. Due to this, it does not adequately cover cloud security and hence the new standard ISO 27017 was released.

It is wise not to assume that the cloud is secure on its own, you need a provider that can demonstrate protection from hacking and guarantee you security.

There are 7 new controls that the ISO 27017 standard brings -

• 3.1 Shared roles and responsibilities within a cloud computing environment
• 1.5 Removal of cloud service customer assets
• 5.1 Segregation in virtual computing environments
• 5.2 Virtual machine hardening
• 1.5 Administrator's operational security
• 4.5 Monitoring of cloud services
• 1.4 Alignment of security management for virtual and physical networks

In this episode, Steve talks through some of these new controls, explains why they're so important, and describes who can benefit from implementing this new standard.

You'll learn

• How the ISO 27017 standard works for both customers and providers.
• How ISO 27017 works as a unique selling point for businesses.
• The new controls that ISO 27017 has and how it demonstrates security within the cloud.
• The benefits of adopting ISO 27017.
• How doing a gap analysis can help you to understand what cloud controls you already have in place.

Resources

• Blackmores

In this episode, we talk about:

[01:30] Why it's important to have a standard for cloud security when we already have ISO 27001.

[02:46] The type of new controls in ISO 27017 and how they make the standard 'cloud effective'.

[05:37] Some examples of the new controls that ISO 27017 has.

[07:20] The prerequisites you need before implementing ISO 27017.

[08:37] The type of certificate you get with ISO 27017.

[10:22] How ISO 27017 can set companies apart from their competitors.

[11:03] What the future for ISO 27001 and ISO 27017 looks like.

[13:03] Advice for anyone thinking of implementing ISO 27017.

[14:20] The main benefits there are from implementing ISO 27017.

If you need assistance with implementing ISO 27017 – Contact us!

We'd love to hear your views and comments about the ISO Show, here's how:

• Share the ISO Show on Twitter or Linkedin
• Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud