Compliance FrameworksInternational
ISO/IEC 27017
Cloud Security Controls: component inventory, supplier attribution, integrity verification.
Cloud Security Controls: component inventory, supplier attribution, integrity verification.
| Short name | ISO 27017 |
| Region | International |
| Country or scope | International |
| Sector | Cloud |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers ISO 27017
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for ISO 27017.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 26: 4 written for ISO 27017 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ISO27017-8.1.1 Inventory of Cloud Assets | Assets associated with cloud services, including software components, must be identified and inventoried (ISO/IEC 27017 §8.1.1, Inventory of assets) | Scan |
ISO27017-12.6.1 Technical Vulnerability Management | Technical vulnerabilities in cloud service software must be identified and addressed in a timely manner, requiring identifiable components (ISO/IEC 27017 §12.6.1, Management of technical vulnerabilities) | Scan |
ISO27017-15.1.3 ICT Supply Chain Attribution | Agreements with suppliers must address risks propagated through the ICT services supply chain, presupposing known suppliers for the components in use (ISO/IEC 27017 §15.1.3, ICT supply chain) | Scan |
ISO27017-12.5.1 Integrity of Installed Software | Installation of software on operational cloud systems must be controlled, supported by integrity hashes for verification (ISO/IEC 27017 §12.5.1, Installation of software on operational systems) | Scan |
ISO27017-12.1.2 Change Management Version Tracking | Changes to systems must be controlled, which requires knowing the version of each software component deployed (ISO/IEC 27017 §12.1.2, Change management) | Scan |
ISO27017-18.1.2 Intellectual Property in Cloud Services | Compliance with intellectual property rights for software used in cloud services must be ensured, requiring license information (ISO/IEC 27017 §18.1.2, Intellectual property rights) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
CLD.6.3.1 | Shared Roles and Responsibilities in Cloud Environments |
CLD.8.1.5 | Removal of Cloud Service Customer Assets |
CLD.9.5.1 | Segregation in Virtual Computing Environments |
CLD.9.5.2 | Virtual Machine Hardening |
CLD.12.1.5 | Administrator Operational Security |
CLD.12.4.5 | Monitoring of Cloud Services |
CLD.13.1.4 | Alignment of Security Management for Virtual and Physical Networks |
A.5.23 | Information Security for Use of Cloud Services |
A.8.9 | Cloud Configuration Management |
A.5.19 | Cloud Supply Chain Security |
A.8.8 | Vulnerability Management in Cloud Environments |
A.8.28 | Secure Development in Cloud Environments |
Policy templates
Written for ISO 27017:
- Cloud Service Agreement Security Policy
- Cloud Configuration and Hardening Policy
- Cloud Security Monitoring Policy
- Cloud Supply Chain Security Policy
And 22 from the standard set, adapted to ISO 27017.