ISO 27017 Assessment

Assess ISO/IEC 27017:2015 cloud security controls for "$ARGUMENTS". Identify the cloud service model, establish shared responsibility boundaries, and evaluate cloud-specific security controls that extend the ISO 27001 baseline.

Arguments. $ARGUMENTS may contain the project name and optional flags. Take the first token as <project> and treat --skip-checks as a flag; never include flags in file paths. All paths below use <project>. If --skip-checks is present, skip the prerequisite check and, before writing any artifact, append one line to .metapowers/compliance/<project>/skip-log.md: - <ISO timestamp> — <skill name> skipped prerequisite check for <artifact file> — reason: <reason or "none given">.

Prerequisites

Read .metapowers/compliance/<project>/00-scope.md. If this file does not exist, tell the user:

Phase 0 (Scope) has not been completed for "<project>". Run /compliance:regulatory-landscape <project> first, or use --skip-checks to bypass.

Process

1. Read context files:

   • Read ${CLAUDE_PLUGIN_ROOT}/shared/grc-lifecycle-guide.md for GRC methodology reference
   • Read ${CLAUDE_PLUGIN_ROOT}/shared/assessment-template.md for output structure
   • Read .metapowers/compliance/<project>/00-scope.md for scope and control framework context

2. Cloud service model identification:

   • Determine cloud service model(s) in use: IaaS, PaaS, SaaS, or hybrid
   • Identify cloud service provider(s) and their certifications
   • Map cloud deployment models: public, private, hybrid, multi-cloud

3. Shared responsibility boundaries:

   • Define responsibility split between cloud service provider (CSP) and cloud service customer (CSC)
   • Map each ISO 27001 Annex A control to responsible party (CSP, CSC, or shared)
   • Document CSP compliance attestations and certifications relied upon
   • Identify controls where responsibility is ambiguous or undocumented

4. Cloud-specific controls assessment:

   • Virtual machine hardening — assess VM image management, secure configuration, hardening baselines
   • Cloud service monitoring — assess monitoring of cloud resources, tenant activity logging, anomaly detection
   • Cloud network security — assess virtual network segmentation, security groups, cloud firewalls, traffic encryption
   • Multi-tenant isolation — assess tenant separation, data isolation, compute isolation, resource boundaries
   • Data location — assess data residency awareness, geographic restrictions, data sovereignty compliance
   • Cloud backup — assess cloud-native backup strategies, cross-region replication, recovery testing
   • Secure development in cloud — assess cloud-native development practices, container security, serverless security, CI/CD pipeline security
   • Score each control: Implemented / Partially Implemented / Not Implemented / CSP Managed

5. ISO 27001 base control extensions:

   • For each ISO 27001 Annex A control, assess cloud-specific extensions defined in ISO 27017
   • Identify controls requiring additional cloud-specific implementation beyond ISO 27001 baseline
   • Document where ISO 27001 controls are sufficient vs. where cloud extensions are needed

6. CSP compliance reliance:

   • Assess which controls are fully delegated to CSP
   • Verify CSP certifications and audit reports (SOC 2, ISO 27001, ISO 27017)
   • Identify risks from CSP reliance (single provider dependency, audit gaps)

7. Write the artifact to .metapowers/compliance/<project>/01-assess/iso27017.md following the assessment template structure with:

   • Cloud Service Model — service and deployment model identification
   • Shared Responsibility Map — control ownership by CSP/CSC/shared
   • Cloud-Specific Controls Assessment — all cloud controls scored
   • ISO 27001 Extensions — additional cloud requirements beyond base controls
   • CSP Compliance Reliance — provider certifications and dependency risks
   • Overall Compliance Score — score = (Implemented + 0.5 × Partially Implemented) ÷ assessed controls, as a percentage, counting CSP Managed as Implemented only where step 6 verified a current CSP certification covering it (otherwise as Partially Implemented); show it with a heatmap
   • Remediation Priorities — ranked list of gaps to address

Output

The ISO 27017 assessment written to .metapowers/compliance/<project>/01-assess/iso27017.md. Present a summary to the user highlighting:

• Cloud service model and provider(s) assessed
• Shared responsibility gaps (controls with unassigned or unclear CSP/CSC ownership)
• Top 3 cloud-specific control gaps
• CSP reliance risks

End the artifact with this paragraph, verbatim:

Not legal or audit advice. This artifact supports preparation for compliance work; certification, attestation and regulatory conclusions require a qualified auditor or counsel.