Cloud Security (ISO/IEC 27017) Fundamentals Training
A one-day fundamentals programme on ISO/IEC 27017. Learn how cloud customers and providers share responsibility for securing cloud services and information. Participants work through practical examples and a guided case before drafting actions for their own organisation.
Who should attend: Cloud, IT, security, procurement, compliance and service management teams. No prior framework knowledge is required.
HRD Corp claim support available
Programme Agenda
9:00 AM to 10:00 AM
Cloud Services and the Standard
Introduce cloud service and deployment models and ISO/IEC 27017's control guidance. Distinguish cloud security controls from an assurance claim that every service configuration is safe.
10:00 AM to 10:15 AM
Break
10:15 AM to 11:30 AM
Shared Responsibilities and Contracts
Map responsibilities across cloud provider, customer and managed service partner. Identify service boundaries, contract questions and assumptions that differ between infrastructure, platform and software services.
11:30 AM to 12:30 PM
Identity, Data and Separation
Explore access, privileged administration, data handling and tenant separation. Match controls to the customer's workload and the provider's underlying service, identifying which evidence each party can supply.
12:30 PM to 1:30 PM
Lunch
1:30 PM to 2:45 PM
Secure Cloud Operations
Discuss configuration, changes, monitoring, virtual resources and incident coordination. Identify useful checks for exposed services, account ownership and visibility gaps without conducting a live cloud assessment.
2:45 PM to 3:00 PM
Break
3:00 PM to 4:00 PM
Assurance, Exit and Lifecycle
Review supplier reports and service descriptions with scope limits in mind. Plan return or deletion of information and responsibilities when services, owners or providers change.
4:00 PM to 5:00 PM
Practical Exercise: A Cloud Responsibility Map
Review a fictional hosted application, assign six security responsibilities and identify evidence. Draft contract questions, monitoring actions and an exit checklist.
Key Outcomes
- Explain cloud customer and provider responsibilities
- Identify common cloud control gaps
- Ask scope-aware supplier assurance questions
- Draft cloud monitoring and exit actions
Training Mode Physical / Online / Hybrid
HRD Corp Subject to programme eligibility and HRD Corp approval
Level Fundamentals / Beginner. No prior framework knowledge required.
Duration 1 Day | 9:00 AM to 5:00 PM (6.5 learning hours, excluding breaks)
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Group case exercise and a 10-question knowledge check
Certificate Orbix Certificate of Completion upon full attendance; not a professional certification
Malaysia Relevance
Relevant to Malaysian cloud providers and businesses using cloud infrastructure or applications. The course references ISO/IEC 27017:2026 and uses responsibility mapping to identify practical gaps between customers and suppliers.
Practical Takeaways
A cloud shared-responsibility map and supplier assurance checklist.
Download a sample practice worksheet (TXT). This fictional exercise is a preview of the learning approach. About Orbix; contact us to confirm the facilitator and relevant experience for your delivery.
Course Completion and Next Steps
Participants receive an Orbix Certificate of Completion upon full attendance. This introductory course does not confer professional certification or establish an organisation's compliance. Further implementation and assessment depend on the organisation's scope and obligations.
Frequently Asked Questions
Related Fundamentals Training
Payment Card Data Security (PCI DSS) Fundamentals Web Application Security (OWASP Top 10) Fundamentals AI Security Controls (CSA AICM) Fundamentals AI Agent Protocol Security (OWASP MCP Top 10) Fundamentals View all fundamentals programmes
Reference material: ISO: ISO/IEC 27017:2026.