Does Moving to a Hyperscaler Put Your ISO 27001 Certification at Risk? A Control-by-Control Answer

Moving from a managed PaaS to AWS, Azure, Google Cloud, Scaleway, or a self-managed Kubernetes environment does not invalidate an ISO/IEC 27001 certification or restart its three-year cycle, because certification applies to an organization’s information security management system rather than its hosting provider. The migration does, however, require updates to the Statement of Applicability, risk assessment, supplier records, asset inventory, architecture documentation, and planned-change records, along with notification to the certification body. Cloud providers’ own ISO certifications can support supplier due diligence and cover underlying physical infrastructure, but customers remain responsible for workload-level controls such as IAM, patching, configuration management, logging, environment separation, and change approvals. The discussion identifies ten Annex A controls particularly affected by deployment practices, emphasizing that audit difficulties commonly arise when evidence is fragmented across cloud consoles, CI systems, Terraform, and informal approval channels. It distinguishes cloud infrastructure providers, compliance automation tools, cloud-security posture management products, and deployment control planes, arguing that the latter can centralize access controls, environment separation, and deployment audit trails but cannot replace broader ISMS governance or certification. It also stresses that auditors assess evidence over time, so organizations should establish and operate new controls well before an audit window, ideally for a full quarter.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.