ISO 27017 Certification in the Philippines — Cloud Security Controls

ISO/IEC 27017:2015 is the international code of practice for cloud-specific information security controls — the standard Philippine cloud service providers, SaaS companies and hosting businesses add to ISO 27001 when clients ask how workloads and data are protected in the cloud specifically. It is not a standalone certificate: it is implemented and certified as an extension of an ISO 27001 information security management system. Sterling International Consulting implements both together, or adds ISO 27017 to the ISMS you already run.

What ISO 27017 adds to ISO 27001

ISO 27001 defines the management system, and its Annex A controls are written for any organization. ISO/IEC 27017 translates them for cloud computing: implementation guidance for the existing controls when services are delivered from or consumed in the cloud, plus seven additional cloud-specific controls covering shared roles and responsibilities, removal and return of cloud customer assets, segregation in virtual computing environments, virtual machine hardening, administrator operational security, monitoring of cloud services, and alignment of virtual and physical network security. If your security documentation still reads as if it were written for an office server room, this is the standard that closes the gap.

Written for providers and customers — both sides of the contract

ISO 27017 is unusual in addressing two audiences at once. Cloud service providers use it to define what they secure and what they expose to customers — and to prove it. Cloud service customers use it to govern what they configure, monitor and remain accountable for. Most Philippine BPO and IT companies are both at the same time: they consume hyperscale infrastructure and deliver services on top of it. The standard forces the question every incident postmortem eventually asks — who was responsible for this control? — and has you answer it in writing before the incident.

Why it matters in the Philippine market

Three commercial drivers. First, enterprise and offshore clients now ask cloud-specific questions in vendor-risk review; generic ISO 27001 answers slow deals that cloud-mapped controls close. Second, government work: DICT’s cloud-first policy direction keeps pushing agencies toward cloud services, and suppliers that can evidence cloud security controls are simply easier to approve. Third, differentiation: the extension separates specialist cloud providers from resellers in a market where most stop at ISO 27001. Pair it with a SOC 2 report when US clients want attestation on top of certification.

How certification works: scope extension, not a separate certificate

There is no accredited standalone ISO 27017 certificate. The mechanism: implement the ISO 27017 guidance inside your ISO 27001 ISMS — extend the risk assessment and Statement of Applicability with the cloud controls — and have your certification body audit them as part of the ISO 27001 audit, at initial certification, at a surveillance visit, or through a scope-extension audit. Your ISO 27001 certificate then references ISO 27017. Companies certifying for the first time should build both in one project; the marginal effort is small compared to running them apart.

ISO 27017 or ISO 27018 — or both?

They answer different questions. ISO 27017 covers cloud security in general: infrastructure, tenancy, operations, both provider and customer roles. ISO 27018 covers one asset class — personally identifiable information processed in a public cloud — with obligations privacy-sensitive clients care about. A hosting or infrastructure provider usually starts with ISO 27017; a BPO or SaaS company processing customer PII usually needs both, with ISO 27701 as the management-system layer above them. We map your client demands to the right stack in a free consultation.

Meet the people behind these projects in the Philippines

Every ISO project we deliver is led by a Sterling consultant — not a helpdesk queue. Our implementation team is based across the country, in Metro Manila, Cebu and Davao, so gap assessments, training days and audit-week support happen at your site, whether you operate in Luzon, the Visayas or Mindanao.

Talk to the expert nearest you: book a free ISO consultation → — we work on-site in Metro Manila, Cebu, Davao and nationwide.

Related guides: ISO 27001 · ISO 27018 · ISO 27001 vs SOC 2 · SOC 1 · SOC 1 vs SOC 2 · SOC Type 1 vs Type 2 · HIPAA · PCI DSS · SOC reports overview