ISO 27017 - Cloud Security Consulting Services Readiness, Implementation, Audit and Program Management

Phase I -Context Establishment

In this phase, we determine your business is in line with Cloud. Questions such as what are the applications, services that are involved here. If you are a service provider, we determine whether you are SAAS, PAAS, or IAAS. This helps in determining which are the applicable areas to cover.

Phase II - Gap Analysis

This phase helps in determining the configuration in scope, on one hand, and determining the applicable requirement and their implementation maturity.

This phase ends with the following deliverables:
1. Applicable requirements
2. Status of each requirement
3. Recommendations – technical and process to fulfill the gaps

Phase III - Control Design and Documentation

This phase involves setting up applicable policies and support in the implementation of gaps.

PHASE IV - Tracking

This phase involves tracking the client risks, technical controls, and documentation on a weekly basis till all internal controls are adequately implemented.

Phase V - Performance Tracking

This phase involves showcasing clients with changes in a given period by providing change specific score of compliance between 0 -100% compliance.

Phase VI - Internal Audit

This phase involves verifying the governance system created for the organization is well in place, and ready to declare as ISO 27017 compliant.

At this stage, the client has completely implemented the governance system.