ISO/IEC 27017 Certification

1. Commitment

Vretta prioritizes cloud-based services' security, confidentiality, and integrity by adhering to the highest information security standards. Our commitment to achieving and maintaining ISO/IEC 27017 certification reflects our dedication to extending our robust Information Security Management System (ISMS) to address the unique challenges of cloud computing environments.

ISO/IEC 27017 is an international standard that provides guidelines for information security controls applicable to cloud services. It builds upon ISO/IEC 27001 by offering cloud-specific recommendations for service providers and customers, helping to ensure transparency, shared responsibility, and effective data protection. Vretta has successfully obtained ISO/IEC 27017 certification, demonstrating our ongoing efforts to secure cloud infrastructure and services in our e-assessment and learning solutions.

Ensuring Compliance with ISO/IEC 27017 Certification:

• Cloud Security Governance: Establishing cloud-specific policies and procedures within our ISMS.
• Risk Management: Assessing and mitigating cloud-related threats, including shared infrastructure risks.
• Responsibility Clarity: Defining roles between cloud provider and customer to ensure accountability.
• Secure Virtualization: Implementing controls for isolation and protection of cloud-based virtual environments.
• Transparency: Providing clear data handling, access, and ownership terms in cloud service agreements.

2. Maintaining ISO/IEC 27017 Certification

To uphold our ISO/IEC 27017 certification, Vretta follows a structured methodology that continually evaluates cloud-specific security risks and implements proactive controls. This includes annual surveillance audits, collaboration with cloud service providers, and regular updates to policies in response to evolving regulatory requirements and industry expectations. ISO/IEC 27017 certification builds upon the foundation of ISO/IEC 27001, and Vretta ensures that cloud environments meet general and cloud-specific security objectives. Our ISMS incorporates:

• Cloud-focused policies and operational controls.
• Incident response and resolution processes tailored to cloud threats.
• Regular internal reviews and training on cloud responsibilities.
• Ongoing monitoring of cloud service performance and security posture.