ISO 27017 Cloud Security Compliance Guide Generator

Act as a Principal Cloud Security Architect and ISO 27017 Lead Implementer with 15+ years of experience in cloud compliance and information security management systems (ISMS). Develop a comprehensive [DOCUMENT_TYPE] for [ORGANIZATION_NAME] implementing ISO/IEC 27017:2015 (Information security controls for cloud services).

**Context & Scope:**
- Organization Profile: [ORG_CONTEXT] (industry, size, regulatory environment, risk appetite)
- Cloud Architecture: [CLOUD_ENV] (AWS/Azure/GCP/Oracle/IBM/Multi-cloud; IaaS/PaaS/SaaS/Hybrid)
- Current Compliance State: [COMPLIANCE_STATE] (Greenfield/ISO 27001 certified/SOC 2/PCI-DSS/Partial implementation)
- Geographic Scope: [REGIONS] (data residency requirements, sovereign cloud needs)
- Target Audience: [AUDIENCE] (C-Suite, CISO, Cloud Engineers, Auditors, DevOps teams)
- Specific Technologies: [TECH_STACK] (Kubernetes, Serverless, Containers, VM-based, DBaaS)
- Timeline: [TIMELINE] (6-month sprint/12-month roadmap/3-year strategy)

**Required Deliverables:**

1. **Executive Strategic Overview** (400-600 words)
   - Business justification for ISO 27017 adoption in [ORG_CONTEXT]
   - Relationship to existing [EXISTING_FRAMEWORKS] and shared responsibility model clarification
   - Resource requirements and ROI projections

2. **ISO 27017 Control Framework Mapping**
   - Detailed mapping of all 121 ISO 27002/27017 controls to [CLOUD_ENV] native security services
   - Cloud-specific implementation guidance for the 7 additional ISO 27017 controls (Clause 5-18):
     * Virtual system hardening and protection
     * Network security management in virtual environments
     * Data segregation in multi-tenant architectures
     * Cloud service customer monitoring
     * Alignment of security management for virtual networks
   - Control effectiveness metrics and testing procedures

3. **Gap Analysis & Current State Assessment**
   - Assessment methodology for [CURRENT_INFRASTRUCTURE]
   - Maturity model scoring (1-5) across 14 control domains
   - Priority matrix (Risk × Effort × Compliance Criticality)
   - Quick wins vs. long-term architectural changes

4. **Implementation Playbooks by Phase**
   - **Phase 1 (Foundation):** Asset inventory, IAM architecture, encryption key management
   - **Phase 2 (Technical):** Network segmentation (micro-segmentation), CSPM configuration, secrets management
   - **Phase 3 (Operational):** SIEM integration for cloud, incident response automation, backup/disaster recovery
   - **Phase 4 (Governance):** Supplier management (CSP contracts), continuous monitoring, audit preparation
   - Include [CODE_EXAMPLES] for infrastructure-as-security (Terraform/CloudFormation/IAM policies) where applicable

5. **Cloud-Specific Security Architecture**
   - Zero Trust implementation for [TECH_STACK]
   - Data lifecycle protection (at rest/transit/in use) with [CLOUD_ENV]-specific encryption options
   - API security and supply chain risk management
   - Container and serverless security controls mapped to ISO 27017

6. **Documentation Templates & Artifacts**
   - Cloud Security Policy (ISO 27017 aligned)
   - CSP Risk Assessment Questionnaire
   - Data Classification and Handling Procedures for cloud environments
   - Incident Response Runbooks specific to cloud threats (credential compromise, misconfiguration, data exfiltration)
   - Internal Audit Checklist (pre-certification readiness)

7. **Metrics, Monitoring & Continuous Compliance**
   - KPIs for control effectiveness (MTTD, misconfiguration rates, compliance drift)
   - Automated compliance scanning architecture using [MONITORING_TOOLS]
   - Dashboard specifications for security posture management

**Formatting Requirements:**
- Reference specific ISO 27017:2015 clause numbers for every control (e.g., "Per Clause 13.1.3...")
- Use professional technical writing standards with executive summary suitable for [AUDIENCE]
- Include [DIAGRAM_DESCRIPTIONS] for architecture flows (marked as [DIAGRAM: description])
- Risk ratings: Critical/High/Medium/Low with CVSS scoring where applicable
- Tables comparing ISO 27017 requirements vs [CLOUD_ENV] native controls vs third-party tools

**Special Considerations:**
Address [UNIQUE_CONSTRAINTS] (e.g., "multi-cloud complexity," "DevSecOps integration challenges," "legacy monolith migration," "regulatory restrictions on cross-border data transfer"). Ensure guidance addresses cloud-native threats: lateral movement in VPCs, privilege escalation via IAM misconfigurations, supply chain attacks on container registries, and API gateway vulnerabilities.

Tone: [TONE_PREFERENCE] (Authoritative and technical / Business-focused with technical appendices / Academic and framework-heavy)