ISO/IEC 27017: Cloud Security

Cloud service providers must explicitly document and communicate which information systems and data elements belong to customers versus those owned/operated by the provider, with detailed responsibility matrices that distinguish between provider-managed infrastructure security, customer-managed application security, and shared security functions.

Data centers must establish formal service level agreements (SLAs) with specific security obligations mapped to each customer's workload tier, including explicit statements about what the provider will and will not secure, preventing the dangerous assumption that 'cloud' means 'the provider secures everything.'.

Data center operators must implement mandatory technical controls for hypervisor hardening including disabled unnecessary services, resource consumption limits per virtual machine to prevent denial-of-service attacks, and secure virtual machine migration protocols that prevent unauthorized data access during movement between physical hosts.

The standard requires documented procedures for virtual machine image management including immutable base images, signed container registries, and automated vulnerability scanning of all virtual machine templates before deployment to production cloud infrastructure.

ISO 27017 mandates that cloud providers implement customer-controlled encryption for data at rest and in transit, with key management systems that ensure customers retain cryptographic control over their own data, preventing CSP access to unencrypted customer information.

Data centers must establish Hardware Security Module (HSM) infrastructure separate from general computing resources, implement key rotation policies that allow customer-initiated key changes without service interruption, and provide documented evidence that encryption key material is never accessible to cloud provider personnel except in narrowly-defined disaster recovery scenarios with mandatory multi-party authorization.

Data center facilities must demonstrate technical enforcement of logical isolation between customer virtual environments through network segmentation, storage isolation, and compute resource boundaries that prevent one customer's workload from accessing another customer's data or performance metrics.

The standard requires regular penetration testing specifically targeting tenant isolation boundaries, documentation of approved hypervisor versions with known isolation vulnerabilities patched, and architectural diagrams showing how customer data flows are physically isolated at the storage, network, and compute layers within multi-tenant infrastructure.

Providers must implement role-based access control (RBAC) systems that allow customers to define and enforce their own access policies within their cloud tenancy without affecting other customers' security posture, including support for multi-factor authentication, single sign-on integration, and customer-defined privileged access management protocols.

Data centers must audit and log all administrative access to customer-facing APIs, explicitly prevent shared credentials between customers and provider support staff, and implement secure credential delivery mechanisms that ensure customer administrative passwords are never visible to CSP personnel.

ISO 27017 requires comprehensive logging of all data access events, configuration changes, and administrative actions within customer tenancies, with immutable audit trails stored separately from production systems and accessible to customers for compliance investigations.

Data centers must implement real-time threat detection capabilities that monitor for anomalous access patterns, unauthorized API calls, and lateral movement attempts between virtual machines, with automated alerting that reaches customer security teams within minutes of incident detection, enabling genuine shared responsibility incident response.

Cloud providers must document explicit data storage locations and processing regions for each customer tenant, with technical controls that enforce geographic boundaries preventing data from being moved to different jurisdictions without customer authorization.

The standard requires implementation of legal and technical mechanisms that prevent government access to customer data without due process, including transparency reporting, customer notification of lawful data demands, and the architectural capability to separate customer data by geographic region even within the same data center facility.

Data centers must implement verified data destruction procedures that guarantee complete removal of customer data when tenancies are terminated, including destruction of all backup copies, cache data, and temporary files created during processing, with cryptographic proof of destruction provided to customers.

The standard mandates that deletion requests are honored within contractually-specified timeframes, that customers can verify non-recovery of deleted data through forensic audits, and that physical media containing customer data is destroyed using approved destruction methods documented and certified by authorized third parties.