Cloud responsibilities
Clarify which security activities are controlled by the cloud provider, the customer or both parties.
CLOUD SERVICES • ISO/IEC 27017:2026
ISO/IEC 27017 Certification in UAE & Dubai
Independent assessment of cloud-service information security controls within a defined scope, covering the cloud services, responsibilities, environments and activities relevant to the organization.
ISO/IEC 27017:2026
Cloud services
Independent assessment
ISO/IEC 27017
Cloud Services Security
CLOUD SECURITY
Clear responsibilities.
Clear responsibilities.
Stronger cloud controls.
Cloud-specific guidance connects information-security controls with provider and customer responsibilities across public, private and hybrid cloud environments.
ISO/IEC 27017 • CLOUD SERVICES
Cloud security controls built around the services and responsibilities in scope.
ISO/IEC 27017:2026 provides cloud-specific guidance and additional controls based on ISO/IEC 27002.
WHAT IS ISO/IEC 27017?
ISO/IEC 27017 certification gives UAE cloud organizations a focused cloud-security framework.
ISO/IEC 27017:2026 provides guidance for implementing information security controls in cloud services. It builds on ISO/IEC 27002 and adds cloud-specific guidance and additional controls for both cloud service providers and cloud service customers.
The standard applies to public, private and hybrid cloud environments. For UAE organizations, it can help make cloud-security responsibilities clearer across hosted platforms, managed services, SaaS, PaaS, IaaS and other cloud arrangements included within the defined scope.
Current ISO/IEC 27017 status
ISO lists ISO/IEC 27017:2026 as the published second edition. ISO/IEC 27017:2015 is withdrawn and the 2026 edition is the current published version.
ISO/IEC 27017 IN PRACTICE
Build cloud-security controls around the service model your organization actually operates.
ISO/IEC 27017 is designed for the realities of cloud computing, where information-security activities and responsibilities can be divided between a provider and a customer. The assessment should therefore reflect the actual cloud services, environments, responsibilities and information flows in scope.
A UAE cloud provider may operate hosted applications, infrastructure services, managed platforms, data-centre services or other cloud offerings. A cloud customer may rely on external providers for business applications, storage, computing, platforms or managed technology services. The relevant controls depend on the cloud relationship and the responsibilities retained by each party.
ISO/IEC 27017:2026 is built on ISO/IEC 27002 and adds cloud-specific guidance and additional controls. Used alongside an ISO/IEC 27001-based information security management system, it can provide a more focused view of cloud-security practices within the organization's information-security scope.
The certification or conformity assessment scope should be specific enough to show which cloud services, sites, platforms, organizational functions and responsibilities were assessed. This prevents the certification statement from being broader than the actual cloud operation.
Cloud service security
Apply cloud-specific security practices to the services, platforms and environments included in scope.
Access control
Consider identity, authentication, authorization and privileged access across provider and customer environments.
Operational security
Control changes, operations, monitoring and service activities that can affect information security in the cloud.
Incident handling
Define responsibilities and communication paths for detecting, reporting and responding to cloud-security incidents.
Customer transparency
Provide suitable information about cloud-security practices, responsibilities and service arrangements.
ISO/IEC 27017 IMPLEMENTATION GUIDE
Turn cloud-security guidance into controls that operate across the services in scope.
Effective implementation connects cloud architecture, information-security responsibilities, operating procedures and evidence. The approach should follow the organization's actual cloud service model rather than a generic technology checklist.
Confirm the cloud service scope
Identify cloud services, platforms, environments, locations, organizational functions and customer responsibilities included in the assessment.
Map shared responsibilities
Document how information-security activities are divided between cloud providers, customers, suppliers and supporting service teams.
Apply cloud-specific controls
Translate the applicable ISO/IEC 27017 guidance and controls into practical operating controls for the cloud services in scope.
Use objective evidence
Maintain records, configurations, logs, reviews and other evidence that demonstrate how the applicable cloud-security controls operate.
Develop cloud-security capability
Give relevant personnel the competence, awareness and information needed to manage provider, customer and technical security responsibilities.
Review cloud-security performance
Use incidents, reviews, testing, customer feedback, audit findings and risk information to strengthen cloud-security practices over time.
UAE BUSINESS CONTEXT
Keep the cloud-security scope aligned with the services actually delivered to customers.
UAE organizations may operate cloud services from data centres, corporate facilities, free-zone locations or distributed technology environments. The assessment scope should accurately describe the services, environments, locations and responsibilities covered.
See the certification process
THE FOUNDATION OF ISO/IEC 27017
Core cloud-security practices behind clear and consistent control.
ISO/IEC 27017 focuses on information security controls for cloud services and the responsibilities shared by cloud service providers and customers.
Cloud service security
Apply information-security controls to the cloud services and environments included within the defined scope.
Shared responsibility
Make provider and customer responsibilities clear for the controls and activities that protect cloud information.
Identity and access
Control access to cloud services, administrative functions, data and supporting technology according to the operating model.
Change management
Control changes to cloud services and supporting environments so security impacts are considered and recorded.
Incident response
Maintain clear responsibilities and communication routes for cloud-security incidents and service events.
Monitoring
Use suitable monitoring and review activities to identify security events, control performance and operational changes.
Information protection
Protect information throughout cloud processing, storage, transfer and service operation according to the applicable scope.
CLOUD PROVIDER + CLOUD CUSTOMER
Use ISO/IEC 27017 according to the responsibilities your organization actually controls.
Cloud security depends on the relationship between providers and customers. A useful assessment begins with the actual services, responsibilities and information flows rather than treating every cloud environment as identical.
PROVIDER
Assess the cloud service operation
Review the provider-side controls, service processes, technology environments, personnel and responsibilities relevant to the cloud services offered.
CUSTOMER
Assess customer-side responsibilities
Consider the security activities retained by the customer, including account management, data handling, access and use of the cloud service.
SCOPE
Define the cloud services and environments
Identify services, platforms, deployment models, sites, organizational functions and information flows included in the assessment.
REVIEW
Evaluate security evidence
Use operational records, monitoring, reviews, testing and other objective evidence to evaluate the applicable controls within scope.
ISO/IEC 27017 CLOUD SECURITY FRAMEWORK
Key cloud-security areas to consider when assessing services and responsibilities.
The assessment should follow ISO/IEC 27017:2026 and the defined scope, with controls selected and applied according to the organization's cloud-security risks and operating context.
CLOUD
Cloud service architecture
Understand the cloud deployment model, services, environments and technology relationships that form the assessed scope.
RESPONSIBILITY
Provider and customer roles
Clarify who performs, monitors and maintains each relevant security activity across the cloud service relationship.
ACCESS
Identity and access control
Control identities, permissions, privileged access and account activities across cloud platforms and supporting systems.
CHANGE
Cloud service changes
Manage changes to cloud environments, configurations and service components with suitable security review and evidence.
INCIDENTS
Cloud-security incidents
Maintain clear detection, escalation, communication and response responsibilities for security incidents affecting cloud services.
INFORMATION
Information protection
Protect information handled through cloud services according to its sensitivity, processing activities and applicable security controls.
ASSURANCE
Monitoring and review
Review cloud-security controls, service performance, security events and evidence to identify areas that need attention.
AUDIT READINESS
Cloud-security evidence should come from the services and environments being assessed.
An effective assessment is supported by objective evidence from normal cloud operations. The evidence set depends on the scope, cloud model, responsibilities and controls selected for assessment.
Service diagrams, deployment information, environment boundaries and responsibility models.
Identity records, access reviews, privileged access controls and relevant authorization information.
Change records, monitoring, incident records, service reviews and operational control evidence.
Applicable testing, vulnerability information, security reviews and follow-up actions.
Contracts, service descriptions, security commitments and communications relevant to customer responsibilities.
Cloud-security measures, incidents, findings and management information used to review control effectiveness.
Security information and oversight for suppliers or sub-processors that affect the cloud services in scope.
Corrective actions, lessons learned and improvement records arising from reviews, incidents or assessment findings.
INDUSTRIES WE CERTIFY
ISO certification across the industries we serve.
Cloud services support critical operations across the UAE economy. ISO/IEC 27017 can be relevant where organizations provide, operate or depend on cloud services and need a clearly defined approach to cloud information security.
Data Centres & Cloud Services
Cloud infrastructure, hosting, managed platforms and data-centre services where provider security responsibilities are central to service delivery.
Explore IndustryIT & Technology
Technology companies, managed service providers and software organizations delivering or operating cloud-based services.
Explore IndustryPower & Energy
Energy and utility organizations using cloud platforms for operational technology support, enterprise systems and information services.
Explore IndustryManufacturing
Manufacturers using cloud applications, connected systems, supplier platforms and digital production support services.
Explore IndustryHealthcare & Medical Services
Healthcare organizations using cloud systems for records, applications, digital services, analytics and supporting operations.
Explore IndustryGovernment & Public Services
Public-sector organizations operating cloud-enabled services and managing information across internal and external platforms.
Explore IndustryFacilities Management
Facilities organizations using cloud platforms for work orders, asset information, service requests and connected operational support.
Explore IndustryRetail & E-commerce
Digital commerce organizations using cloud platforms for customer data, applications, transactions and service operations.
Explore Industry
ISO/IEC 27017 CERTIFICATION SCOPE
Your ISO/IEC 27017 assessment should describe the cloud service actually assessed.
Scope definition is central to a useful cloud-security certification programme. It identifies the cloud services, environments, locations, organizational functions and responsibilities covered by the assessment.
For organizations operating in Dubai, Abu Dhabi or other UAE emirates, the scope should accurately describe the cloud service model and the activities performed by the organization and its relevant providers.
Cloud services
Define the hosted, managed, platform or infrastructure services included in the assessment scope.
Deployment model
Identify the public, private or hybrid cloud environments relevant to the assessed services.
Sites & functions
Clarify locations, departments, technology teams and supporting functions included in the assessment.
Provider responsibilities
Describe the security activities controlled by the organization and the responsibilities shared with customers or suppliers.
ISO/IEC 27017 CERTIFICATION PROCESS
From cloud-security scope definition to independent assessment and ongoing evaluation.
The certification programme is planned around the cloud services, environments, responsibilities, organizational functions and readiness of the applicant. The sequence below shows a typical route.
Define the certification scope
Provide the cloud services, environments, locations, responsibilities, organizational functions and intended ISO/IEC 27017 scope.
Operate the cloud-security controls
Establish and operate the applicable cloud-security practices and maintain objective evidence through normal service operations.
Readiness review
Review the defined scope, cloud architecture, responsibility model, operational controls and evidence available for the assessment.
Certification audit
Assess the applicable cloud-security controls and supporting evidence against the agreed scope and certification programme.
Certification decision
Assessment results and applicable findings proceed through the certification decision process of the certification body.
Surveillance and improvement
Continue operating, reviewing and improving cloud-security controls throughout the certification cycle where surveillance applies.
BENEFITS OF ISO/IEC 27017
Why organizations in Dubai and the UAE use ISO/IEC 27017 for cloud security.
ISO/IEC 27017 can help cloud providers and customers create clearer security responsibilities, stronger cloud controls and more transparent information-security practices within the services in scope.
Stronger cloud security
Apply cloud-specific information-security guidance to the services and environments covered by the organization’s scope.
Clearer responsibilities
Make provider and customer security responsibilities easier to define, communicate and review.
Focused control practices
Use additional cloud-focused controls and guidance alongside the broader ISO/IEC 27002 control framework.
Better transparency
Provide clearer information about cloud-security practices and the responsibilities associated with the service relationship.
Improved customer confidence
Support customer conversations with independently assessed information-security practices within the stated scope.
Independent assurance
Where an applicable certification programme is used, independent assessment can provide evidence of cloud-security controls within the defined scope.
AFTER ISO/IEC 27017 ASSESSMENT
Cloud-security assurance is maintained through active operational control.
Cloud environments change continuously. Maintaining the assessed security practices therefore depends on ongoing review, evidence, responsibility management and improvement across the services in scope.
Internal review
Review cloud-security controls, service changes, access, incidents and other operational information relevant to the scope.
Management review
Give leadership suitable information about cloud-security performance, incidents, risks, customer matters and improvement priorities.
Corrective action
Address identified control weaknesses, investigate relevant causes and verify that corrective actions are effective.
Continual improvement
Use lessons learned, security events, technology changes and assessment findings to strengthen cloud-security practices over time.
ISO/IEC 27017 FAQ
Frequently asked questions about ISO/IEC 27017 certification in UAE.
Clear answers about ISO/IEC 27017:2026, cloud services, certification scope, assessment and the relationship with the ISO/IEC 27000 family.
Request an ISO/IEC 27017 QuoteWhat is ISO/IEC 27017 certification in the UAE?
ISO/IEC 27017 certification services in the UAE involve an independent assessment of applicable cloud-security controls and practices within a clearly defined scope. The assessment should identify the cloud services, responsibilities, locations and activities covered and explain how the programme relates to ISO/IEC 27001 where applicable.
What is ISO/IEC 27017:2026?
ISO/IEC 27017:2026 is an International Standard providing guidance for implementing information security controls in cloud services. It builds on ISO/IEC 27002 and adds cloud-specific guidance and additional controls for cloud service providers and cloud service customers.
What changed in ISO/IEC 27017:2026?
ISO/IEC 27017:2026 is the second edition, published in July 2026. ISO lists ISO/IEC 27017:2015 as withdrawn and ISO/IEC 27017:2026 as the published edition. The current edition has a revised title and updated cloud-security guidance based on the current ISO/IEC 27002 control framework.
Who uses ISO/IEC 27017?
ISO/IEC 27017 is relevant to cloud service providers and cloud service customers. It can support organizations operating or procuring public, private or hybrid cloud services where responsibilities for information security are shared across customer and provider environments.
Does ISO/IEC 27017 apply to public, private and hybrid cloud?
Yes. ISO states that ISO/IEC 27017:2026 applies to all cloud deployment models, including public, private and hybrid cloud environments. The controls selected should reflect the organization’s risk assessment and the cloud services in scope.
How does ISO/IEC 27017 relate to ISO/IEC 27001?
ISO/IEC 27017 provides cloud-specific guidance and controls based on ISO/IEC 27002, while ISO/IEC 27001 is the management-system standard used for ISO/IEC 27001 certification. A cloud organization can use ISO/IEC 27017 to strengthen the cloud-security aspects of an ISO/IEC 27001-based information security management system.
How does ISO/IEC 27017 relate to ISO/IEC 27002?
ISO/IEC 27017 builds on ISO/IEC 27002 by adding cloud-specific guidance and additional controls for cloud services. ISO/IEC 27002:2022 is the current general information-security control standard referenced by the 2026 edition of ISO/IEC 27017.
Can a cloud service provider use ISO/IEC 27017?
Yes. Cloud service providers are one of the primary audiences for ISO/IEC 27017. The standard helps address cloud-specific security responsibilities, provider activities, customer-provider relationships and the controls applicable to the cloud services in scope.
Can a cloud customer use ISO/IEC 27017?
Yes. ISO/IEC 27017 also addresses cloud service customers. It can help organizations define and evaluate their information-security responsibilities when using cloud services and when responsibilities are shared with a provider.
What can be included in an ISO/IEC 27017 certification scope?
The scope can identify the cloud services, platforms, environments, locations, organizational functions, information-security activities and customer-provider responsibilities covered by the assessment. The wording should accurately describe the services and activities that are assessed.
What does an ISO/IEC 27017 assessment look at?
Depending on the agreed scope and certification programme, an assessment can examine cloud-security controls, responsibility allocation, access management, operational security, incident handling, supplier and customer arrangements, service changes, monitoring, information protection and evidence that the applicable controls operate as intended.
Is ISO/IEC 27017 certification mandatory in the UAE?
ISO/IEC 27017 certification is not universally mandatory for every organization in the UAE. A customer, tender, contract, procurement programme or sector-specific framework may request particular cloud-security evidence. Any obligation should be confirmed against the applicable contract or regulatory context.
How long does ISO/IEC 27017 certification take in the UAE?
There is no single timeline for every organization. Duration depends on the cloud services in scope, number of environments and locations, organizational responsibilities, existing information-security practices, evidence available for assessment and the applicable certification programme.
Can ISO/IEC 27017 be used with ISO/IEC 27018?
Yes. ISO/IEC 27018:2025 focuses on protecting personally identifiable information in public clouds when the cloud service provider acts as a PII processor. It can complement cloud-security controls covered through ISO/IEC 27017 when both subjects are relevant to the organization’s services.
Does ISO itself issue ISO/IEC 27017 certificates?
No. ISO develops and publishes International Standards but does not perform ordinary certification. Organizations seeking independent certification or conformity assessment engage an external certification body operating under the applicable certification programme.
How does ISO/IEC 27017 address shared responsibility in cloud services?
ISO/IEC 27017 addresses the division of information-security responsibilities between cloud service providers and cloud service customers. The assessment scope should make the relevant responsibilities, service boundaries and control ownership clear for the cloud services being considered.
Can ISO/IEC 27017 be applied to a private cloud?
Yes. ISO/IEC 27017:2026 applies to public, private and hybrid cloud deployment models. For a private cloud, the application should reflect the actual relationships, infrastructure ownership and responsibilities between the parties involved.
What cloud environments can be covered by an ISO/IEC 27017 programme?
A programme can address cloud services and environments within a defined scope, including public, private or hybrid deployments. The scope should identify the relevant services, platforms, environments, locations and organizational responsibilities being assessed.
Does ISO/IEC 27017 replace ISO/IEC 27001?
No. ISO/IEC 27017 is cloud-specific guidance and control information based on ISO/IEC 27002. ISO/IEC 27001 is the management-system standard used for ISO/IEC 27001 certification; organizations may use ISO/IEC 27017 to address cloud-security aspects within their wider information-security framework.
What is the current edition of ISO/IEC 27017?
ISO lists ISO/IEC 27017:2026 as the current published edition, Edition 2, published in July 2026. ISO/IEC 27017:2015 is listed as withdrawn and has been replaced by the 2026 edition.
AUTHORITATIVE ISO REFERENCES
ISO/IEC 27017 information and certification guidance.
Technical information about ISO/IEC 27017:2026, its relationship with ISO/IEC 27002 and related cloud-security standards is referenced against official ISO publications.
ISO.ORG · OFFICIAL SOURCE
ISO/IEC 27017:2026 — Cloud services
Official ISO page for the current second edition, published in July 2026.
Open official source
ISO.ORG · OFFICIAL SOURCE
ISO/IEC 27001:2022 — Information security management
Official ISO page for the current information security management system standard.
Open official source
ISO.ORG · OFFICIAL SOURCE
ISO/IEC 27002:2022 — Information security controls
Official ISO information on the control standard that forms the foundation for ISO/IEC 27017:2026.
Open official source
ISO.ORG · OFFICIAL SOURCE
ISO/IEC 27018:2025 — Public cloud PII protection
Official ISO page for the current public-cloud privacy protection standard.
Open official source
ISO/IEC 27017 CERTIFICATION IN UAE
Start your ISO/IEC 27017 programme with a clearly defined cloud-service scope.
Share your cloud services, deployment model, environments, locations, customer responsibilities and supporting technology so the appropriate ISO/IEC 27017 assessment programme can be considered.
Request an ISO/IEC 27017 Certification Quotation
