# An Analysis of Cloud Security Frameworks, Problems and Proposed Solutions
## 3 Cloud Security Frameworks
### Iso 27017:2015
#### 3.3.3 Required Steps to Implement  
To implement ISO 27017 in your organization, you would normally take the following steps:  
1. Acquaint yourself with the Standard: Obtain a copy of ISO 27017 and thoroughly read it. Understand the standard's objectives, requirements, and recommendations. 2. Examine Your Present Cloud Environment: Assess your current cloud infrastructure, platforms, and services. Determine how ISO 27017 might assist in addressing possible risks and gaps in security controls. 3. Form a Project Team: Within your organization, form a team that will be in charge of implementing ISO 27017. Stakeholders from IT, security, legal, compliance, and other relevant areas should be included. 4. Conduct a gap analysis to match your present security practices to ISO 27017's standards and recommendations. Determine which areas require improvement or extra controls. 5. Create an Implementation strategy: Develop a thorough strategy including the actions, milestones, and dates for adopting ISO 27017. Determine the risk and criticality of the actions. 6. Implement Security Controls: Follow ISO 27017's specified security controls and procedures. Access controls, encryption, data segregation, incident response protocols, and supplier management are some examples. 7. Provide training and awareness programs to educate staff on the significance of cloud security and their duties under ISO 27017. This ensures that everyone knows their duties in safeguarding information assets in the cloud. 8. Documentation and Policies: Create and maintain documentation that proves ISO 27017 compliance. Policies, processes, risk assessments, incident response plans, and records of security occurrences and their resolution may be included. 9. Regular evaluation and Improvement: Monitor and evaluate your cloud security on a regular basis to guarantee continuing compliance with ISO 27017. Conduct audits, risk assessments, and evaluations on a regular basis to identify areas for improvement and execute necessary adjustments. 10. Third-Party Evaluation: Consider hiring a third-party auditor or consultant to evaluate your cloud security practices in relation to ISO 27017. They may conduct an impartial assessment of your compliance and make recommendations for improvement. To efficiently implement and manage ISO 27017 in organizations, a variety of tools and resources are available. The following are some necessary tools for implementing ISO 27017:  
ISO 27017 is an addition to ISO 27001, which offers the overarching foundation for developing an Information Security Management System (ISMS). Understand the larger context and standards within which ISO 27017 functions by being acquainted with the ISO 27001 standard. ISO 27017 Standard Document: Obtain a copy of the ISO 27017 standard. This paper specifies the standards, rules, and principles for safeguarding data in cloud computing systems. It is used as a reference to guarantee that the ISO 27017 requirements are followed. Tools for Risk Assessment: Risk assessment is a critical component of the ISO 27017 application. Various risk assessment techniques and frameworks can help in detecting andanalyzing hazards in cloud computing systems. The NIST Risk Management Framework (RMF) or industry-specific risk assessment methodology are two examples. Tools for Evaluating Cloud Service Providers (CSPs): It is critical to analyze CSP security capabilities and adherence to ISO 27017 criteria when selecting and assessing CSPs. Cloud security evaluation questionnaires and vendor security assessment frameworks, for example, can help in assessing and comparing CSPs based on their security controls and practices. Cloud Security Monitoring and Management Tools: Putting in place effective security controls and monitoring in a cloud environment frequently necessitates the use of specialized tools. These technologies aid in the monitoring of cloud infrastructure, the detection of security issues, the management of access restrictions, and the enforcement of security rules.