Cloud-specific controls based on ISO/IEC 27017 and ISO/IEC 27018 and best practices
Domain 4 tests your ability to select cloud-specific controls using ISO/IEC 27017 and ISO/IEC 27018, and to place them in the shared responsibility matrix. ISO/IEC 27017 extends ISO/IEC 27002 with cloud guidance for providers and customers; ISO/IEC 27018 adds guidance for public cloud providers processing PII as processors.
Core rules and concepts
- ISO/IEC 27017 control themes include shared roles and responsibilities, removal or return of customer assets, segregation in virtual environments, virtual machine hardening, administrator operational security and alignment of virtual and physical network security.
- ISO/IEC 27018 PII themes include consent and purpose, transparency, data minimisation, retention, subprocessor controls, disclosure, breach notification, audit rights, return or deletion and location.
- Controls are role-dependent: customer, provider and partner. A control can be shared, but accountability must still be assigned.
- Certification supports assurance; it does not prove your configuration or your controller duties are compliant.
- Best practice: map each control to owner, implementation, evidence, test and review date.
Worked example
An IaaS database holds customer data. The provider controls physical access, the hypervisor and the underlying network. The customer controls guest OS patching, database accounts, encryption keys, backups, logging and deletion verification. Network segregation is shared. The matrix names each duty and its evidence. If the customer assumes the provider patches the guest OS, the control fails.
Traps
Confusing ISO/IEC 27017 with ISO/IEC 27001; treating ISO/IEC 27018 as covering controller obligations; applying provider controls without customer evidence; omitting asset removal and subprocessors.