ISO/IEC 27017:2015: the clauses behind the split

The cloud service customer's information security policy should address the use of cloud services: which information may be placed in which services, who may procure them, how the customer keeps accountability for information a provider processes, and the provider's obligations the customer expects to see in the agreement. The cloud service provider's policy should cover the security of the cloud service it delivers, including its baseline of protection for customer information, multi-tenancy, customer access to the service's security functions, and the boundary between its responsibilities and the customer's.

Roles and responsibilities for the security of each cloud service should be allocated between the cloud service customer and the cloud service provider and inside each organisation. The customer should assign who owns the relationship, who manages customer-side controls and who evaluates the provider's information; the provider should state which responsibilities it accepts and which remain with the customer for each service it offers, so that no control falls between the two.

The cloud service customer's asset inventory should record the information and assets it holds in each cloud service, so that cloud-hosted assets are not invisible to its own management. The cloud service provider should inventory the assets associated with the cloud service, including the assets of each customer that it holds, in a way that lets it identify and separate them by customer.

The customer should label information according to its classification before and while it is in a cloud service, using labelling the service can carry, and the provider should describe what labelling capability the service offers and whether labels survive processing. Both should agree how labels are handled where the provider's staff can see customer information.

Privileged access in a cloud service sits on both sides. The customer should control the privileged rights it holds over its tenancy, using strong authentication and keeping the number of privileged users small, and the provider should control privileged access of its own staff to the cloud service and to customer environments, with the assurance the customer asks for. The provider should offer sufficient authentication techniques for the customer's privileged accounts.

Cryptographic keys used by the service should be explained to the customer: the provider should give information about the keys the service uses and the key management options available, including whether the customer may manage its own keys and how keys are protected and destroyed. The customer should decide who manages the keys for its cloud-hosted information and should keep management of keys it controls under its own key management policy.

The provider should arrange for secure disposal or re-use of equipment that has held customer information, so that customer data cannot be recovered from storage that is retired or reassigned to another tenant, and should tell customers about the arrangement. The customer should confirm that the provider's disposal practice meets its requirements for the information it places in the service.

The provider should specify the backup capabilities it offers, including scope, frequency, retention, protection of the backups and how the customer may restore, and should state what it does not back up. The customer should decide which of its cloud-hosted information needs backup, whether to rely on the provider's backups or keep its own, and should test that restoration works.

Technical vulnerabilities in a cloud service are divided between what the provider patches and what the customer patches, and the provider should give the customer information about how it manages vulnerabilities affecting the cloud service, including the parts the provider patches and the parts the customer must patch itself, and the notification it gives. The customer should manage vulnerabilities in the components it controls (its virtual machines, applications and configuration) and should track the provider's handling of the rest.

Where the customer develops applications on a cloud service, its secure development policy should address the cloud environment, including the provider's development tools and interfaces and the security of code and data in shared development resources. The provider should give customers information about the secure development practices and the interfaces it makes available.

The agreement between customer and provider should set out the information security requirements for the cloud service, including the responsibilities of each party, the provider's controls, handling of customer information, incident notification, the customer's rights to information and audit, and what happens at termination. The provider should offer terms that state these, and the customer should confirm the agreement covers its requirements before it uses the service.

The provider should identify the peer cloud services and suppliers on which the cloud service depends and should tell the customer how information security requirements are passed to them, since a weakness in a sub-provider is a weakness in the service. The customer should ask for that information and should include the provider's supply chain in its own risk assessment.

The provider should give the customer a mechanism to report information security events it observes in the cloud service, and should report to the customer events and incidents affecting the customer's information within the agreed time. The customer should report to the provider events it detects that may affect the service, and should tell its own users how to report events involving cloud services.

Responsibilities for information security in the use of a cloud service are shared, and the standard requires that they be allocated to identified parties, documented, communicated and implemented by both the cloud service customer and the cloud service provider. The provider should document and publish the responsibilities it takes on and those it leaves with the customer; the customer should record the allocation, assign owners inside its organisation, and act on its share.

Assets of the cloud service customer that are on the cloud service provider's premises are to be removed, and returned where necessary, in a timely manner when the cloud service agreement ends. The provider should describe how customer assets are returned and deleted at termination, in what form and within what time; the customer should plan for termination from the start, including retrieval of its data in a usable format and confirmation of deletion.

A customer's virtual environment running on a cloud service is to be protected from other customers of the service and from unauthorised persons. The provider should enforce logical segregation between tenants across compute, storage and network, should segregate its own management environment from customer environments, and should describe the segregation to customers; the customer relies on that segregation and should verify the description before placing sensitive information in the service.

Virtual machines in a cloud computing environment are to be hardened to meet business needs. Whichever party configures a virtual machine should apply hardening: only needed ports, protocols and services enabled, unnecessary components removed, and technical controls such as anti-malware and logging appropriate to the workload; the customer hardens the machines it controls and the provider those it operates, including the images it offers to customers.

Procedures for administrative operations of a cloud computing environment are to be defined, documented and monitored. The provider should document how its administrators operate the service and monitor their activity; the customer should document the administrative procedures for its own use of the service, covering critical operations such as configuration changes, backup and restore, and access management, and should monitor that they are followed, because a mistaken administrative action in a cloud console can affect the whole tenancy.

The cloud service customer is to have the capability to monitor specified aspects of the operation of the cloud services it uses. The provider should give customers the means to monitor the aspects relevant to their security, such as service availability, security events and the use of their resources, and should describe those capabilities; the customer should decide which aspects it needs to monitor and should use the capabilities provided, supplementing them where the provider's monitoring is not enough.

When virtual networks are configured, the consistency of configurations between virtual and physical networks is to be verified against the provider's network security policy. The provider should apply the same network security policy to the virtual networks it provides as to its physical networks, should verify the two stay consistent when virtual networks are created or changed, and should describe the arrangement to customers; the customer should confirm the description meets its requirements for the virtual networks it uses.