Name each control owner
Record which tasks sit with your organisation and which depend on the provider.
ISO/IEC 27017 · Cloud security responsibilities
ISO/IEC 27017 cloud file sharing responsibilities
When a contractor leaves a project, who removes their access and who can prove it happened? Use a real handover scenario to review customer and provider responsibilities.
Check the handover between duties
Identify the event that triggers a change and how the other party is notified.
Test the agreed process
Use a sample account to verify who makes the change and who reviews the evidence.
Trusted with valuable business data
Assign ownership of cloud controls
Compare the provider’s documented responsibilities with the settings your team administers.
Describe the service boundary.
List the controls the customer configures and the services the provider operates.
Name the responsible parties.
Assign an owner to routine tasks and exceptions on both sides of the service.
Test the handovers.
Walk through a change of reviewer and identify who removes access and checks the evidence.
Walk through a change of recipient
Ask both parties to describe the steps, evidence and escalation route when a project reviewer changes.
A colleague changes role
Customer question: Who decides which recipients, permissions and workspaces should change?
Provider question: Which administrative controls are available, and how are changes applied?
Joint check: Can the team verify that the intended change took effect?
A security event is reported
Customer question: Who owns the internal response and business-impact assessment?
Provider question: What support, information and notification arrangements are available?
Joint check: Are contact routes and responsibilities understood before an incident?
The service relationship ends
Customer question: Which information must be returned or retained elsewhere?
Provider question: What retrieval, deletion and service-closure arrangements apply?
Joint check: Is the exit plan realistic for the information and workflow involved?
Make shared responsibility specific enough to use.
A responsibility chart should describe actions that people can carry out. For a cloud file-exchange workflow, test each entry by asking who initiates the action, who performs it and what evidence confirms the result.
| Operational event | Responsibilities to clarify |
|---|---|
| A user leaves the business | Your team identifies the change and follows its access-removal process. Ask the provider which administrative actions are available and what evidence confirms their effect in the service. |
| A configuration needs changing | Identify who can request and approve the change, who implements it and how the outcome is checked. Include the impact on existing recipients and active exchanges. |
| An incident needs investigation | Agree how internal responders and provider support will work together. Clarify the information available, the contact route and any dependencies that could delay the response. |
Keep the responsibility map current.
Cloud arrangements change over time. Revisit the agreed operating model when the service, its use or the people responsible for it change. The review should reconnect written responsibilities with the workflow being used in practice.
- Before expanding the use case
- Check whether a new team, data type or external recipient changes the assumptions behind the original review.
- After a service change
- Ask whether a release, configuration change or support arrangement affects the controls your team relies on.
- When an owner changes
- Transfer the responsibility record and open actions to the new owner. Confirm the contact still works by walking through a representative support or access request.
Prepare for the conversation
- Your responsibility map
- Bring the current allocation of customer and provider duties.
- One operational change
- Use an access change, configuration request or incident handover.
- An evidence question
- Identify what would demonstrate that the agreed action was completed.
Make the boundary part of the brief.
Bring a real business process using sample data. Discuss responsibilities with MX before turning a file-sharing requirement into a service decision.
Review your cloud exchangeQuestions for
your review.
Does ISO/IEC 27017 replace ISO/IEC 27001?
No. They have different roles. ISO/IEC 27017 adds guidance for cloud security controls; consider it alongside the relevant management-system and control framework.
Is the guidance only for public clouds?
No. The standard also addresses private and hybrid cloud models. Responsibilities should reflect the actual arrangement.
Is MX certified to ISO/IEC 27017?
This page makes no certification claim. Request current evidence and check its scope, service coverage and relevance to your deployment.
Is the responsibility map a contract?
No. It is an illustrative starting point for discussion. Confirm the allocation of duties in the applicable service arrangements and internal procedures.