ISO/IEC 27017-ed.2.0

Annotation of standard text ISO/IEC 27017-ed.2.0 :

This document provides guidance for information security controls, based on ISO/IEC 27002, applicable to the provision and use of cloud services. This document provides:

• additional guidance for relevant controls specified in ISO/IEC 27002:2022;
• additional controls with guidance that specifically relate to cloud services.

This document provides controls and guidance for cloud service customers (CSCs) and cloud service providers (CSPs). This document is considered to be a horizontal document as it provides a foundation and a common understanding of security regarding the provision and use of cloud services. NOTE This document applies to all types of cloud deployment models including the private cloud. When applying this document to the private cloud, the controls and guidance of this document are applicable, although adjustments can be necessary to adapt to the relationships and abilities of an organization’s internal departments. Le present document fournit des recommandations pour les mesures de securite de linformation, fondees sur lISO/IEC 27002, qui sont applicables a la fourniture et a lutilisation des services en nuage. Le present document fournit:

• des recommandations supplementaires concernant les mesures de securite pertinentes specifiees dans lISO/IEC 27002:2022;
• des mesures de securite supplementaires avec des recommandations specifiquement liees aux services dinformatique en nuage.

Le present document fournit des mesures de securite et des recommandations destinees aux clients de services en nuage (CSC) et aux fournisseurs de services en nuage (CSP). Le present document est pris en consideration comme un document transversal, car il fournit une base et une vision commune de la securite en matiere de disposition et dutilisation des services en nuage. NOTE Le present document sapplique a tous les types de modeles de deploiement dans le nuage, y compris le nuage prive. Lors de lapplication du present document au nuage prive, les mesures et les recommandations du present document sont applicables, bien que des ajustements puissent etre necessaires pour sadapter aux relations et aux aptitudes des services internes dun organisme.