ISO/IEC 27017 supplements ISO 27002 with specific security controls for cloud services, defining guidelines for cloud providers and customers. Covers shared responsibility model, virtual machine management, multi-tenant environment segregation, data protection in transit and at rest, logging, monitoring, and incident response in public, private, and hybrid cloud infrastructures.