ISO 27001 & ISO 27017 & ISO 27018 Cloud Documentation
Toolkit
Note: The documentation should preferably be implemented in the order in which it is listed here.
The order of implementation of documentation related to Annex A is defined in the Risk Treatment
Plan.
Number Document Relevant clauses in Mandatory Required by ISO Required by ISO
in the name the Standard according 27017** 27018**
package to ISO
27001
0. Procedure for ISO/IEC 27001 7.5
Document and
Record Control ISO/IEC 27018
A.9.2
1. Project Plan
2. Procedure for ISO/IEC 27001 4.2
Identification of and A.18.1.1
Requirements
ISO/IEC 27017
18.1.1
ISO/IEC 27018
A.9.2 and A.11.1
2.1. Appendix – List ISO/IEC 27001 4.2
of Legal, and A.18.1.1
Regulatory,
Contractual and ISO/IEC 27017
*
Other 18.1.1
Requirements ISO/IEC 27018
A.11.1
3. ISMS Scope ISO/IEC 27001 4.3
Document
Ver. 1.0, 2016-06-24 Page 1 of 13
Number Document Relevant clauses in Mandatory Required by ISO Required by ISO
in the name the Standard according 27017** 27018**
package to ISO
27001
4. Information ISO/IEC 27001 5.2
Security Policy and 5.3
ISO/IEC 27017
5.1.1
ISO/IEC 27018
5.1.1 and A.9.2
4. Cloud Security ISO/IEC 27001
Policy standard, clauses
A.12.1.1, A.12.1.3,
A.12.4.1, A.12.4.3,
A.12.4.4, A.13.1.3,
A.14.2.4
ISO/IEC 27017
6.1.1, 9.4.4, 12.1.3,
12.4.1, 12.4.4,
13.1.3, 18.1.2,
CLD.6.3.1,
CLD.9.5.1,
CLD.9.5.2,
CLD.12.1.5,
CLD.12.4.5 and
CLD.13.1.4
ISO/IEC 27018
12.4.1 and A.9.2
Ver. 1.0, 2016-06-24 Page 2 of 13
Number Document Relevant clauses in Mandatory Required by ISO Required by ISO
in the name the Standard according 27017** 27018**
package to ISO
27001
4. Policy for Data ISO/IEC 27001
Privacy in the A.5.1.1, A.7.1.2,
Cloud A.12.4.1, A.12.4.2,
A.14.3.1, A.16.1.2
and A.18.1.4
ISO/IEC 27017
5.1.1, 12.4.1,
16.1.2
ISO/IEC 27018
5.1.1, 11.2.7,
12.4.1, 12.4.2,
12.4.3, 16.1.2,
A.1.1, A.2.1, A.2.2,
A.5.1, A.5.2, A.7.1,
A.9.1, A.9.2, A.10.1
and A.10.2
5. Risk ISO/IEC 27001
Assessment and 6.1.2, 6.1.3, 8.2,
Risk Treatment and 8.3
Methodology
5.1. Appendix 1 – ISO/IEC 27001
Risk 6.1.2 and 8.2
Assessment
Table
5.2. Appendix 2 – ISO/IEC 27001
Risk Treatment 6.1.3 and 8.3
Table
5.3. Appendix 3 – ISO/IEC 27001 8.2
Risk and 8.3
Assessment and
Treatment
Report
Ver. 1.0, 2016-06-24 Page 3 of 13
Number Document Relevant clauses in Mandatory Required by ISO Required by ISO
in the name the Standard according 27017** 27018**
package to ISO
27001
6. Statement of ISO/IEC 27001
Applicability 6.1.3 d)
ISO 27017, all
clauses from
sections 5 to 18
and Annex A
ISO 27018, all
clauses from
sections 5 to 18
and Annex A
7. Risk Treatment ISO/IEC 27001
Plan 6.1.3, 6.2 and 8.3
8. (Annex A –
controls)
8. Bring Your Own ISO/IEC 27001
A.6 Device (BYOD) A.6.2.1, A.6.2.2
Policy and A.13.2.1
ISO/IEC 27018
13.2.1 and A.9.2
8. Mobile Device ISO/IEC 27001
A.6 and A.6.2 and A.11.2.6
Teleworking
Policy ISO/IEC 27017
11.2.6
ISO/IEC 27018
11.2.6
Ver. 1.0, 2016-06-24 Page 4 of 13
Number Document Relevant clauses in Mandatory Required by ISO Required by ISO
in the name the Standard according 27017** 27018**
package to ISO
27001
8. Confidentiality ISO/IEC 27001
A.7 Statement A.7.1.2, A.13.2.4
and A.15.1.2
ISO/IEC 27017
7.1.2, 13.2.4 and *
15.1.2
ISO/IEC 27018 7.1,
13.2.4, 15 and
A.10.1
8. Statement of ISO/IEC 27001
A.7 Acceptance of A.7.1.2
ISMS
Documents ISO/IEC 27017 *
7.1.2
ISO/IEC 27018 7.1
8. Inventory of ISO/IEC 27001
A.8 Assets A.8.1.1 and A.8.1.2
*
ISO/IEC 27017
8.1.1 and 8.1.2
8. Acceptable Use ISO/IEC 27001
A.8 Policy A.6.2.1, A.6.2.2,
A.8.1.2, A.8.1.3,
A.8.1.4, A.9.3.1,
A.11.2.5, A.11.2.6,
A.11.2.8, A.11.2.9, *
A.12.2.1, A.12.3.1,
A.12.5.1, A.12.6.2,
A.13.2.3 and
A.18.1.2
Ver. 1.0, 2016-06-24 Page 5 of 13
Number Document Relevant clauses in Mandatory Required by ISO Required by ISO
in the name the Standard according 27017** 27018**
package to ISO
27001
8. Information ISO/IEC 27001
A.8 Classification A.8.2.1, A.8.2.2,
Policy A.8.2.3, A.8.3.1,
A.8.3.3, A.9.4.1
and A.13.2.3
ISO/IEC 27017
15.1.2
8. Access Control ISO/IEC 27001
A.9 Policy A.9.1.1, A.9.1.2,
A.9.2.1, A.9.2.2,
A.9.2.3, A.9.2.4,
A.9.2.5, A.9.2.6,
A.9.3.1, A.9.4.1
and A.9.4.3
ISO/IEC 27017
6.1.1, 9.2.1, 9.2.2,
9.2.3, 9.2.4, 9.2.5, *
9.2.6, 9.3.1, 9.4.1,
9.4.2 and 9.4.3
ISO/IEC 27018
6.1.1, 9.1, 9.2.1,
9.2.2, 9.2.3, 9.2.4,
9.2.5, 9.2.6, 9.4.2,
A.9.2, A.10.8,
A.10.9 and A.10.10
8. Password Policy ISO/IEC 27001
A.9 (Note: it may be A.9.2.1, A.9.2.2,
implemented as A.9.2.4, A.9.3.1
part of Access and A.9.4.3
Control Policy)
ISO/IEC 27017
9.2.4
ISO/IEC 27018
9.2.1 and A.9.2
Ver. 1.0, 2016-06-24 Page 6 of 13
Number Document Relevant clauses in Mandatory Required by ISO Required by ISO
in the name the Standard according 27017** 27018**
package to ISO
27001
8. Policy on the ISO/IEC 27001
A.10 Use of A.10.1.1, A.10.1.2
Cryptographic and A.18.1.5
Controls
ISO/IEC 27017
10.1.1 and 18.1.5
ISO/IEC 27018
A.9.2 and A.11.1
8. Clear Desk and ISO/IEC 27001
A.11 Clear Screen A.11.2.8 and
Policy (Note: it A.11.2.9
may be
implemented as
part of
Acceptable Use
Policy)
8. Disposal and ISO/IEC 27001
A.11 Destruction A.8.3.2 and
Policy (Note: it A.11.2.7
may be
implemented as ISO/IEC 27017
11.2.7
part of
Operating ISO/IEC
Procedures for 2701811.2.7,
ICT) A.9.2, A.10.7 and
A.10.13
8. Procedures for ISO/IEC 27001
A.11 Working in A.11.1.5
Secure Areas
Ver. 1.0, 2016-06-24 Page 7 of 13
Number Document Relevant clauses in Mandatory Required by ISO Required by ISO
in the name the Standard according 27017** 27018**
package to ISO
27001
8. Operating ISO/IEC 27001
A.12 Procedures for A.8.3.2, A.11.2.7,
Information and A.12.1.1, A.12.1.2,
Communication A.12.3.1, A.12.4.1,
Technology A.12.4.3, A.13.1.1,
A.13.1.2, A.13.2.1,
A.13.2.2 and
A.14.2.4
ISO/IEC 27017
11.2.7, 12.1.2, *
12.1.3, 12.3.1,
12.4.1 and 12.4.3
ISO/IEC 27018
11.2.7, 12.1.4,
12.3.1, 12.4.1,
13.2.1, A.9.2,
A.10.4, A.10.5,
A.10.6 and A.11.2
8. Change ISO/IEC 27001
A.12 Management A.12.1.2 and
Policy (Note: it A.14.2.4
may be
implemented as ISO/IEC 27017
part of 12.1.2
Operating ISO/IEC 27018
Procedures for A.9.2
ICT)
8. Backup Policy ISO/IEC 27001
A.12 (Note: it may be A.12.3.1
implemented as
ISO/IEC 27017
part of
Operating 12.3.1
Procedures for ISO/IEC 27018
ICT) A.12.3.1 and A.9.2
Ver. 1.0, 2016-06-24 Page 8 of 13
Number Document Relevant clauses in Mandatory Required by ISO Required by ISO
in the name the Standard according 27017** 27018**
package to ISO
27001
8. Information ISO/IEC 27001
A.13 Transfer Policy A.13.2.1, A.13.2.2
(Note: it may be
implemented as ISO/IEC 27018
A.9.2, A.9.3, A.10.4
part of
Operating and A.10.5
Procedures for
ICT)
8. Secure ISO/IEC 27001
A.14 Development A.14.1.2, A.14.1.3,
Policy A.14.2.1, A.14.2.2,
A.14.2.5, A.14.2.6,
A.14.2.7, A.14.2.8,
A.14.2.9 and
A.14.3.1 *
ISO/IEC 27017
14.2.1 and 14.2.9
ISO/IEC 27018
A.9.2
8. Appendix – ISO/IEC 27001
A.14 Security A.14.1.1
Requirements
Specification ISO/IEC 27017
14.1.1 *
ISO/IEC 27018
A.4.1
Ver. 1.0, 2016-06-24 Page 9 of 13
Number Document Relevant clauses in Mandatory Required by ISO Required by ISO
in the name the Standard according 27017** 27018**
package to ISO
27001
8. Supplier ISO/IEC 27001
A.15 Security Policy A.7.1.1, A.7.1.2,
A.7.2.2, A.8.1.4,
A.14.2.7, A.15.1.1,
A.15.1.2, A.15.1.3,
A.15.2.1 and
A.15.2.2
ISO/IEC 27017
7.2.2, 15.1.2,
15.1.3 and
CLD.8.1.5
ISO/IEC 27018
7.2.2 and A.9.2
Ver. 1.0, 2016-06-24 Page 10 of 13
Number Document Relevant clauses in Mandatory Required by ISO Required by ISO
in the name the Standard according 27017** 27018**
package to ISO
27001
8. Appendix – ISO/IEC 27001
A.15 Security Clauses A.7.1.2, A.14.2.7,
for Clients, A.15.1.2 and
Suppliers and A.15.1.3,
Partners
ISO/IEC 27017
6.1.1, 6.1.3, 8.2.2,
9.2.1, 9.2.2, 9.2.4,
9.4.1, 9.4.4, 10.1.1,
11.2.7, 12.1.2,
12.1.3, 12.3.1,
12.4.1, 12.4.4,
12.6.1, 14.1.1,
14.2.1, 15.1.2,
15.1.3, 16.1.1,
16.1.2, 16.1.7,
18.1.1, 18.1.3, *
18.1.5, 18.2.1,
CLD.6.3.1 and
CLD.8.1.5
ISO/IEC 27018
5.1.1, 6.1.1, 6.1.3,
9.2, 9.4.1, 10.1.1,
12.1.4, 12.3.1,
12.4.1, 16.1,
18.2.1, A.1.1,
A.5.1, A.9.1,
A.10.1, A.10.3,
A.10.4, A.10.5,
A.10.6, A.10.11,
A.10.12 and A.11.1
Ver. 1.0, 2016-06-24 Page 11 of 13
Number Document Relevant clauses in Mandatory Required by ISO Required by ISO
in the name the Standard according 27017** 27018**
package to ISO
27001
8. Incident ISO/IEC 27001
A.16 Management A.7.2.3, A.16.1.1,
Procedure A.16.1.2, A.16.1.3,
A.16.1.4, A.16.1.5,
A.16.1.6 and
A.16.1.7
ISO/IEC 27017 *
16.1.1,
16.1.2,16.1.7 and
18.1.2
ISO/IEC 27018
16.1.1 and A.9.2
8. Appendix – ISO/IEC 27001
A.16 Incident Log A.16.1.6
8. Disaster ISO/IEC 27001
*
A.17 Recovery Plan A.17.1.2
9. Training and ISO/IEC 27001 7.2
Awareness Plan and 7.3
10. Internal Audit ISO/IEC 27001 9.2
Procedure
10.1. Appendix 1 – ISO/IEC 27001 9.2
Annual Internal
Audit Program
10.2. Appendix 2 – ISO/IEC 27001 9.2
Internal Audit
Report
Ver. 1.0, 2016-06-24 Page 12 of 13
Number Document Relevant clauses in Mandatory Required by ISO Required by ISO
in the name the Standard according 27017** 27018**
package to ISO
27001
10.3. Appendix 3 – ISO/IEC 27001 9.2
Internal Audit
Checklist ISO/IEC 27017, all
clauses from
sections 5 to 18
and Annex A
ISO/IEC 27018, all
clauses from
sections 5 to 18
and Annex A
11. Management ISO/IEC 27001 9.3
Review Minutes
12. Procedure for ISO/IEC 27001 10.1
Corrective
Action
12.1. Appendix – ISO/IEC 27001 10.1
Corrective
Action Form
*The listed documents are only mandatory if the corresponding controls are identified as applicable
in the Statement of Applicability.
**The marked documents are developed according to ISO 27017 and/or 27018.
To learn how to fill in these documents see:
1) Our series of video tutorials http://advisera.com/27001academy/documentation-tutorials/
2) Our series of webinars http://advisera.com/27001academy/webinars/
Ver. 1.0, 2016-06-24 Page 13 of 13
