ISO 27017 changes
after eleven years

On 27 July 2026 ISO and IEC published the second edition of ISO/IEC 27017, the standard that explains how to apply information security controls to cloud services. The previous edition dated from 2015 and has been withdrawn. In eleven years the cloud has become the norm for companies of every size, ISO/IEC 27002 has been rewritten and ISO/IEC 27001 has moved to its 2022 edition: 27017 was the last piece of the picture still built on the old structure. This article explains what has changed, what is worth asking your cloud provider and what happens to existing certificates.

What ISO/IEC 27017 is, and what it is not

ISO/IEC 27017 is not a certification. It is a code of practice: it takes the controls of ISO/IEC 27002 and explains, for each one, what it means in the cloud, adding a few controls that only exist there. It is applied within an ISO/IEC 27001 certified management system, and no certification body issues a standalone 27017 certificate. When a provider claims to be “27017 certified”, it actually holds an ISO 27001 certificate that states the application of the 27017 guidelines, with the reference edition. That is also the case for our certifications.

The standard speaks to both sides of the contract. To the cloud service provider, which must show how it protects the infrastructure and the data it hosts. To the cloud service customer, which remains responsible for what it puts in the cloud and how it configures it. The 2026 edition adds a third figure, the cloud service partner: whoever sits in between, such as managed service providers, integrators and brokers. It is the exact description of an MSP (Managed Service Provider) like AtWorkStudio, which designs and runs its customers’ cloud on third-party platforms: for the first time the standard says that its roles, too, must be written into an agreement.

What changes compared with the 2015 edition

The main change is structural. The 2015 edition followed ISO/IEC 27002:2013, with 14 domains and 114 controls, and added seven cloud-only controls identified by the CLD prefix. The 2026 edition follows ISO/IEC 27002:2022, with 93 controls in four themes (organisational, people, physical, technological), the CLD identifiers disappear and cloud guidance is distributed inside the existing controls, with the same attribute-based presentation as 27002. Of the seven dedicated controls, four remain: two inherited from 2015 and two new ones.

A correspondence annex in the standard maps every 2015 control to its new location, so anyone who already has a mapping does not start from scratch. The substance of the technical requirements changes little: those who already segregated virtual environments, documented administrative procedures and returned data at contract end find the same topics in a different place. The real novelties are three: the partner as a formal role, shadow cloud addressed explicitly for the first time with 8.36, and the guidance on authority requests under 5.31, which we turn to now.

Control 5.31 and the Revolut case

Control 5.31 of ISO/IEC 27002:2022 covers legal, statutory, regulatory and contractual requirements. The cloud guidance of 27017:2026 adds a precise point for cloud service providers: how to handle requests for access to customer data coming from an authority, whether the police, the judiciary or a supervisory authority. The standard asks for three things.

• 1Assess every request on a legal basis, to verify that the legal ground is valid: who signs it, under which law, with which order.
• 2Notify the affected customer, unless the law expressly forbids it.
• 3Disclose only the data covered by the request, not everything held on that customer.

It sounds obvious until you read what happened to Revolut. On 11 September 2026 the digital bank started notifying customers and on the 12th it publicly confirmed that it had disclosed sensitive data to an unauthorised third party, after receiving requests from an email domain belonging to a legitimate government agency. According to reconstructions in the Italian press, the requests came from a genuine certified mailbox of a prefecture, went on for about six months and concerned around 680 European customers: identity documents, verification images, IBANs, statements and transaction histories. No intrusion into any system. The data left because someone sent it, in reply to a request that looked right. Revolut only realised when it phoned the agency, which denied ever having asked for anything.

The other two steps can also be seen in the negative in the Revolut case: customers were notified after the fact, not when the request arrived, and the disclosure covered the entire identity verification file. The standard invents nothing new; it puts in writing a procedure every cloud provider should already have: record the request, verify it through an independent channel, have it assessed on a legal basis before any disclosure, inform the customer and hand over only what was asked for, keeping a record of everything.

What to ask your cloud provider

27017:2026 gives the customer a list of concrete questions. You do not need to read the standard to ask them: you just need to know what answer to expect.

One more question concerns the customer itself: how many cloud services are active in the company outside official channels, paid with a company card and never inventoried? 8.36 asks to detect and prevent this unauthorised use, and the simplest way to do it is to start from identity: if every service goes through the company identity system, whatever does not go through it becomes visible.

Transition: what happens to certificates

For ISO/IEC 27001:2022 there was a three-year transition period, the same for everyone. For 27017:2026, at the time of writing, no formal transition period has been announced: as a code of practice applied within the 27001 certificate, the date that matters is the one set by the certification body, which in turn can audit against the new edition only after its accreditation body has extended its scope. In the meantime, certificates citing 27017:2015 remain valid, and at the end of August 2026 the major public cloud providers still declared conformity with the 2015 edition.

Our ISO/IEC 27001 certificate currently applies the ISO/IEC 27017:2015 and ISO/IEC 27018:2025 guidelines, alongside ISO 9001. Alignment with 27017:2026 is under way, starting from the correspondence annex and the new points, and will be verified by the certification body at the next review. The choice of where the data lives and the list of sub-processors are already public, because transparency towards the customer is where the standard starts.