Shared responsibility
Who does what between customer and provider has to be written down, assigned and reviewed. Without a clear matrix, each side assumes the other has it covered.
ISO/IEC 27017:2026 · Information security for cloud services
Cloud security: what's yours to do as a customer and as a provider.
In the cloud, part of the security comes from your provider and part from you. Audexa first asks what role you play, then guides you control by control through your share: shared responsibility, isolation, console access, logs, encryption and service exit.
- 64 controls from the 2026 edition
- Guidance for customer, provider or both
- Mappings to ISO 27001 and ISO 27018
ISO 27017 self-assessmentProvider
61%
Implementation levelSample data
- Governance and shared responsibility74%
- Identities and cloud console access58%
- Virtualization and isolation66%
- Logging and monitoring49%
- Encryption and key management55%
64 ISO/IEC 27017:2026 controls with guidance and steps to meet them
14 areas, from cloud governance to infrastructure changes
80 ISO 27017 ↔ ISO 27001 mappings to reuse answers
43 ISO 27017 ↔ ISO 27018 mappings
What ISO 27017 adds
ISO 27017 brings information security down to earth for cloud services.
It's a code of practice that extends the ISO/IEC 27002 controls with specific guidance for cloud service customers and providers. The 2026 edition follows the ISO/IEC 27002:2022 numbering.
Agreement with the cloud partner
Security obligations, incident and change notification, data location and service exit are agreed in the contract.
Tenant isolation
The provider has to segregate each customer's virtual environments and securely wipe shared resources before reusing them.
Administrative access
Consoles, APIs and the control plane concentrate the risk: federated identities, protected root credentials and reviewed privileged access.
Logging and oversight
Logging of control-plane activity, monitoring of usage and a common time reference between customer and provider.
Unauthorized cloud use
The 2026 edition includes detecting cloud services used without approval, as well as misuse of the service and of customer accounts.
How Audexa helps
A cloud self-assessment that understands your role.
The questionnaire, action plan and evidence adapt to whether you consume cloud services, provide them or both.
Assess
Only the questions that match your role.
Scoping question
Tell us whether you're a customer, a provider or both, and see how many questions your questionnaire will have.
How to assess it
Each control explains what to check and when the answer is Yes, Partial or No.
Applicability with a reason
Mark what doesn't apply or is out of scope and record why.
Remediate
Concrete steps for every gap.
How to meet it
Steps, expected evidence, suggested owner, closure criterion and when to review it.
Task plan
Findings become tasks with subtasks, an owner and dates.
Cloud and SaaS policy
Start from the “Cloud and SaaS Security Policy” and the “Information Security Policy”, the 2 templates linked to ISO 27017 in the library of 67.
Prove
Evidence for your certification body and your customers.
Evidence vault
Responsibility matrix, contracts, logs and proof linked to each control.
PDF and Excel report
Score, findings and action plan ready for management or the audit.
Re-audit
Assess again as you close gaps and measure progress.
Some features depend on your plan and active modules.
Customer, provider or both
Each role sees the guidance that applies to it.
A cloud customer reviews how it buys, configures and monitors its services. A provider reviews what it offers its customers: a published matrix, isolation, available logs and encryption options. An MSP that uses third-party IaaS and delivers a SaaS ticks both roles.
- Common questions that are always shown
- Customer guidance: inventory, service approval, exit plan
- Provider guidance: isolation, change and incident notification
- Number of questions shown before you start
ISO 27017 scoping questionYour role
- Cloud service customer40 questions
- Cloud service provider35 questions
- Customer and provider (MSP)64 questions
What it covers
The topics that actually get reviewed in a cloud environment.
The questionnaire is organized into 14 areas, from cloud governance to infrastructure as code. Each control comes with how to assess it and how to meet it, with concrete evidence.
- Shared responsibility matrix and agreement with the provider
- Tenant isolation and administrative access to consoles
- Encryption and key management (BYOK and HYOK), virtual networks and logs
- Change and incident notification, and service exit
ISO 27017 findingsAction plan
- Responsibility matrix not reviewedGovernance
- Root credentials without MFAConsole access
- Service exit planNot documented
- Control-plane logsCentralized
ISO 27001 and ISO 27018
Connect ISO 27017 with your ISO 27001 and ISO 27018.
Each pair of controls has a relationship, a coverage level (high, partial or low), a rationale and a source. When you create the audit, Audexa estimates how much your other audits cover, and answers with high coverage arrive as proposals marked "Review it" for a person to confirm.
- 80 mappings to ISO/IEC 27001:2022
- 43 mappings to ISO/IEC 27018 for personal data in the cloud
- "How much does what I have cover?" before you start
- Only high coverage proposes a "Yes"
ISO 27017 mappings123 pairs
- ISO/IEC 27001:202280 pairs
- ISO/IEC 27018:202543 pairs
- High coverageProposes a Yes · "Review it"
- Partial or low coverageNo proposed answer
How it works
Three steps to get the security of your cloud services in order.
Tell us your role
Customer, provider or both. See how much your existing work covers and mark the applicability of each control.
Assess with guidance
Answer control by control with Yes, Partial, No or N/A and get your score and findings.
Close gaps and prove it
Assign tasks, approve the cloud policy, collect evidence and run the assessment again.
Plans
ISO 27017 is included from the Premium plan.
The Free and Core plans don't include ISO 27017. Pricing depends on the size of your team: we give you a fixed proposal in the demo.
Premium
RecommendedFor teams running one or more cloud services.
- ISO 27017 and the other new frameworks in 1.6.1
- 10 audits a month and 3 users
- Policies, evidence, tasks and re-audits
- PDF and Excel reports and the Aude assistant
- 200 assets per section
Diamond
For providers and MSPs with several teams.
- Unlimited audits and users
- Everything in Premium
- Unlimited assets
- vRadar: CVE exposure of your inventory
Before and after
Cloud security in spreadsheets vs. in Audexa.
AreaWithout a platformWith Audexa
Responsibilities
Each side assumes the other has it
Guidance by role: customer, provider or both
Gaps
Loose notes after a review
Tasks with subtasks, owner and closure criterion
Evidence
Contracts and screenshots in folders
Evidence vault linked to each control
ISO 27001
Redoing the work for the cloud
80 mappings with their rationale
Follow-up
One review a year
Re-audits and measurable progress
Frequently asked questions
What people usually ask us about ISO 27017.
Does Audexa certify us for ISO 27017?
No. Certification is issued by an accredited certification body, usually as part of an ISO 27001 certification. Audexa helps you prepare with a guided self-assessment, an action plan and your evidence.
Is ISO 27017 for cloud providers or for customers too?
Both. The standard gives guidance to those who provide cloud services and to those who use them. In Audexa you choose your role before the questionnaire and see the guidance that applies; if you're both, like an MSP, you tick both.
What changes in the 2026 edition?
Audexa uses the 2026 edition, which follows the ISO/IEC 27002:2022 numbering and keeps cloud-specific controls such as shared roles, the agreement with the cloud partner, segregation in virtual environments and detecting unauthorized use of cloud services.
We already have ISO 27001. Do we start from scratch?
No. Many ISO 27017 controls extend ISO 27002 controls you already work on for ISO 27001. Audexa has 80 mappings to ISO 27001 and 43 to ISO 27018, estimates how much your existing work covers and, when coverage is high, proposes the answer for a person to review.
Does the questionnaire reproduce the standard?
No. The text of ISO/IEC 27017 belongs to ISO. The questions, the assessment guidance and the steps to meet each control are written by Audexa.
Which plan do I need for ISO 27017?
ISO 27017 is available on the Premium and Diamond plans. Free and Core don't include it. In the demo we look at which plan fits your team.
Request a demo
See your ISO 27017 self-assessment in action.
In a 30-minute demo we walk through the customer or provider scoping, the guidance per control and the action plan.
- We look at the role you play in your cloud services.
- We show how much your ISO 27001 work already covers.
- We explain which plan fits your team.