ISO 27017 / ISO 27018

  • Who it's for

    Cloud service providers, and organizations that use cloud services.

  • Problems we solve

    Concerns about cloud security and personal-data protection, or tenders requiring ISO 27017/27018.

  • Benefits

    Strengthen cloud-specific security controls and meet cloud information-security and PII-protection requirements.

ISO 27017 (cloud security) & ISO 27018 (cloud PII protection)

Cloud services are a clear trend, but organizations often worry about security before adopting the cloud: is data safe, can the provider see personal data, is availability as claimed? Some public agencies now require ISO 27017 and ISO 27018 certification in tenders. Information security is only one of several cloud-assurance factors, and cloud services differ from ordinary IT outsourcing — which is why different verification mechanisms may be needed.

ISO has not defined a complete standard for cloud services as a whole; it addresses the security portion via ISO 27017 and ISO 27018. These are guidance extending the ISO 27002 controls — not complete management systems — so adopting them requires an ISO 27001 ISMS as the foundation, with the extended/additional controls mapped to internal/external issues and risks.

ISO/IEC 27001 and 27002 were revised in 2022; ISO/IEC 27018 was published in a new edition in 2025 (aligned with ISO/IEC 27002:2022) and ISO/IEC 27017 has also been revised in 2026 (the 2015 edition retired in July 2026). Organizations should base adoption on the latest editions.

ISO 27017 provides additional cloud-specific implementation guidance based on ISO/IEC 27002, with controls described for both cloud customers and providers, plus new controls addressing cloud-specific risks. ISO 27018 establishes controls, objectives and guidelines for protecting PII in public-cloud environments, based on the privacy principles of ISO/IEC 29100 and extending ISO/IEC 27002 with additional controls. In practice, adoption should extend the existing Statement of Applicability to design and add the relevant controls.

Interested in adoption and consulting? Contact us and a specialist will assist you.