Identify the owner
List the provider and customer decisions involved in releasing the file.
ISO/IEC 27017 · Cloud security responsibilities
ISO/IEC 27017 controls for cloud file exchange
A cloud provider may operate the platform while your organization selects the recipients. Map those responsibilities for a sample release and test what happens when access needs to change.
Locate shared tasks
Record where one party’s action depends on information from the other.
Verify the handoff
Request the evidence each party can supply for a completed access change.
Trusted with valuable business data
Document customer and provider duties
Assign each decision to an owner and identify where evidence of its operation is held.
Describe the service boundary.
List the controls the customer configures and the services the provider operates.
Name the responsible parties.
Assign an owner to routine tasks and exceptions on both sides of the service.
Test the handovers.
Walk through a change of reviewer and identify who removes access and checks the evidence.
Test an access change
Use a sample project to check who approves, applies and verifies removal of a recipient.
A colleague changes role
Customer question: Who decides which recipients, permissions and workspaces should change?
Provider question: Which administrative controls are available, and how are changes applied?
Joint check: Can the team verify that the intended change took effect?
A security event is reported
Customer question: Who owns the internal response and business-impact assessment?
Provider question: What support, information and notification arrangements are available?
Joint check: Are contact routes and responsibilities understood before an incident?
The service relationship ends
Customer question: Which information must be returned or retained elsewhere?
Provider question: What retrieval, deletion and service-closure arrangements apply?
Joint check: Is the exit plan realistic for the information and workflow involved?
Make shared responsibility specific enough to use.
A responsibility chart should describe actions that people can carry out. For a cloud file-exchange workflow, test each entry by asking who initiates the action, who performs it and what evidence confirms the result.
| Operational event | Responsibilities to clarify |
|---|---|
| A user leaves the business | Your team identifies the change and follows its access-removal process. Ask the provider which administrative actions are available and what evidence confirms their effect in the service. |
| A configuration needs changing | Identify who can request and approve the change, who implements it and how the outcome is checked. Include the impact on existing recipients and active exchanges. |
| An incident needs investigation | Agree how internal responders and provider support will work together. Clarify the information available, the contact route and any dependencies that could delay the response. |
Keep the responsibility map current.
Cloud arrangements change over time. Revisit the agreed operating model when the service, its use or the people responsible for it change. The review should reconnect written responsibilities with the workflow being used in practice.
- Before expanding the use case
- Check whether a new team, data type or external recipient changes the assumptions behind the original review.
- After a service change
- Ask whether a release, configuration change or support arrangement affects the controls your team relies on.
- When an owner changes
- Transfer the responsibility record and open actions to the new owner. Confirm the contact still works by walking through a representative support or access request.
Prepare for the conversation
- Your responsibility map
- Bring the current allocation of customer and provider duties.
- One operational change
- Use an access change, configuration request or incident handover.
- An evidence question
- Identify what would demonstrate that the agreed action was completed.
Make the boundary part of the brief.
Bring a real business process using sample data. Discuss responsibilities with MX before turning a file-sharing requirement into a service decision.
Review your cloud exchangeQuestions for
your review.
Does ISO/IEC 27017 replace ISO/IEC 27001?
No. They have different roles. ISO/IEC 27017 adds guidance for cloud security controls; consider it alongside the relevant management-system and control framework.
Is the guidance only for public clouds?
No. The standard also addresses private and hybrid cloud models. Responsibilities should reflect the actual arrangement.
Is MX certified to ISO/IEC 27017?
This page makes no certification claim. Request current evidence and check its scope, service coverage and relevance to your deployment.
Is the responsibility map a contract?
No. It is an illustrative starting point for discussion. Confirm the allocation of duties in the applicable service arrangements and internal procedures.