CyphrQ
Menu

ISO 27017 vs 27018: Cloud Security and Privacy Standards Explained

ISO/IEC 27017 covers cloud security controls; ISO/IEC 27018 covers personal data in public clouds. What each adds and what to ask providers.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

9 min read

ISO/IEC 27017 adds cloud-specific security guidance, and ISO/IEC 27018 adds guidance for protecting personal data when a public cloud provider processes it for you. Both build on ISO/IEC 27002. Neither is a standalone certificate in the way ISO/IEC 27001 is, so when a provider says it "has 27017 and 27018", the useful question is what exactly was audited, against which edition.

What are ISO/IEC 27017 and ISO/IEC 27018, and who publishes them?

Both are published jointly by ISO and the IEC. They sit in the ISO/IEC 27000 family, the information security series that ISO/IEC 27001 anchors.

  • ISO/IEC 27017 gives guidance on information security controls for cloud services. ISO's own page says it builds on ISO/IEC 27002 with cloud-specific guidance and additional controls, for both cloud customers and cloud providers, across public, private and hybrid clouds. The current edition is Edition 2, published July 2026, and it replaces the 2015 edition, which ISO now lists as withdrawn. See ISO's page for ISO/IEC 27017.
  • ISO/IEC 27018 gives guidance for protecting personally identifiable information (PII, meaning data that can identify a person) in public cloud services where the provider acts as a PII processor. The current edition is Edition 3, published August 2025, replacing the 2019 edition. See ISO's page for ISO/IEC 27018.

A processor is an organisation that handles personal data on behalf of another organisation and does not decide why the data is used. The organisation that decides is the controller. In the usual cloud arrangement, you are the controller and the provider is your processor. Microsoft describes the same split in its ISO/IEC 27018 compliance page.

A practical warning: many provider pages and older articles still cite ISO/IEC 27017:2015 and ISO/IEC 27018:2019. Those were correct when written. Both have since been replaced, so check which edition a certificate names.

What does ISO/IEC 27017 cover?

Think of 27002 as a general catalogue of security controls, and 27017 as the cloud annotation on top of it. It adds guidance for two audiences at once: the customer who buys cloud services and the provider who runs them.

The idea that matters most is shared responsibility. In the cloud, some controls are the provider's job (the data centre, the hypervisor), some are yours (who has access to your tenant, how you configure storage), and some are both. The ISO27k Forum, an independent practitioner group, describes the second edition as adding cloud-specific controls on shared roles and responsibilities, agreements with cloud service partners, segregation in virtual computing environments, and detection and prevention of unauthorised use of cloud services. The standard text is paid and was not checked here, so confirm the exact control list in the standard before you plan around it.

What does ISO/IEC 27018 cover?

ISO/IEC 27018 is about privacy inside the provider's service. It tells a provider acting as PII processor how to assess risk and apply controls to personal data it holds for customers.

Microsoft's page summarises what that means for customers, in its own words:

  • You are told which countries or regions your data may be stored in.
  • Your data is not used for marketing or advertising without your explicit consent, and that consent cannot be a condition of using the service.
  • There is a policy for returning, transferring and securely disposing of personal data within a reasonable time.
  • The provider discloses the identities of subprocessors, the other companies that may access your data.
  • The provider complies only with legally binding disclosure requests and notifies you unless the law forbids it.

The same page says the standard is based on EU data protection law. It is a code of practice, not a law, so it does not replace your obligations under the GDPR or the UAE PDPL. It helps you evaluate a provider's processing, nothing more.

Can you be certified against ISO/IEC 27017 and ISO/IEC 27018?

ISO describes both as guidance. In practice, providers show conformity through an independent audit, and the wording differs between providers.

  • Amazon Web Services says its ISO/IEC 27017:2015 certification "covers the security management process and cloud provider specific controls". The auditor is EY CertifyPoint, described as accredited by the Dutch Accreditation Council, and the page says its certificates are recognised in countries with an IAF member. AWS adds that customers running workloads on AWS "are not automatically certified by association".
  • Microsoft says an accredited third-party certification body audits Azure for ISO/IEC 27001 and ISO/IEC 27018 at least once a year. The auditors validate in their statement of applicability that in-scope services have incorporated the 27018 controls. Microsoft names BSI as the auditor of its 27018 certificates for Office 365.

Notice the difference. AWS calls it a certification of 27017. Microsoft describes 27018 as audited as part of the 27001 certification process. Both are real, and they are not the same artefact. That is why you ask for the document rather than rely on a logo.

How do ISO/IEC 27017 and 27018 relate to other standards?

  • ISO/IEC 27001 sets the requirements you get certified against. 27017 and 27018 add cloud and privacy guidance to the same control set. The SOC 2 vs ISO 27001 comparison explains how auditors treat 27001.
  • ISO/IEC 27002 is the general control catalogue both standards build on.
  • CSA Cloud Controls Matrix and STAR is a cloud control framework from the Cloud Security Alliance with its own assurance programme. See CSA Cloud Controls Matrix and STAR explained.
  • ISO/IEC 42001 covers AI management. If your cloud provider also hosts AI services, see the ISO/IEC 42001 explainer.

You will find the rest of the family on the ISO standards subtopic page.

How does a 27017 or 27018 audit or adoption work in practice?

For a provider, the steps resemble any ISO management system audit.

  1. Run an ISO/IEC 27001 management system, since that is the base.
  2. Decide which 27017 and 27018 controls apply to which services, and record the decision in the statement of applicability.
  3. Operate the controls and keep records.
  4. Have an accredited certification body audit scope, controls and evidence.
  5. Stay audited every year. Microsoft says its services are subject to annual third-party reviews.

For a customer, adoption is different. You do not certify "against" 27017 because you use a cloud. AWS says plainly that you must get your own assessment if you want your own certification. Microsoft says the same: you can use its attestation in your assessment, but you are responsible for engaging an assessor and for the controls in your own organisation.

Going deeper: for security and IT teams

Read the certificate, not the badge. A credible package has four parts: the certificate (certification body, accreditation, validity dates, edition of each standard), the scope statement (which services, which regions), the statement of applicability, and the audit or assessment report. AWS says its covered services are listed on its ISO Certified page and the in-scope regions in a linked certificate PDF. Microsoft links its audit assessment report for ISO 27001, 27018 and 27017 from its Service Trust Portal. Pull them and compare against the services and regions you actually use.

Match the scope to your deployment. The most common gap I would look for is a certified service list that omits the service you adopted last quarter, or a region that your data actually sits in. Treat any unlisted service as uncovered until the provider shows otherwise.

Check the edition. ISO's own listing shows the 2015 edition of 27017 and the 2019 edition of 27018 as replaced. A certificate issued to the old edition can be valid today. Ask when the provider will transition and what the auditor's plan is. A provider that cannot answer is telling you something.

Map shared responsibility into your own control set. Take each cloud-specific control area (roles and responsibilities, segregation between tenants, detection of misuse) and write down, per service, what the provider does and what you do. Typical customer-side items: tenant administrator roles, conditional access and MFA, storage and network configuration, log export, and key management settings. Provider evidence covers the provider half only.

For 27018, trace the processor chain. Ask for the subprocessor list, the data location commitments, deletion and return terms, and the disclosure-request policy. Compare each with your data processing agreement. These are the items Microsoft lists as 27018 outcomes, so a provider that claims alignment should be able to point to each one.

Evidence an auditor asks of you as a customer:

  • Cloud service inventory with an owner and a data classification per service.
  • Supplier due diligence file: certificates, scope, reports and review dates.
  • Documented responsibility split for each critical service.
  • Configuration baselines and proof they are monitored.
  • Log retention and exit plan for each provider.

Common nonconformities, described generally. Certificates collected once and never rechecked for expiry. Shadow SaaS with no due diligence file (see shadow AI at work). A contract that does not match the controls the provider claims. Customer-side controls marked as done by pointing at the provider's certificate, which cannot reach them.

Questions to ask a provider:

  1. Which edition of 27017 and 27018 does your certificate cite, and when do you transition?
  2. Is conformity covered by a certificate or inside your 27001 statement of applicability, and can I see it?
  3. Which services and regions are in scope?
  4. Who is your accredited certification body?
  5. Where can I read the latest audit report, and under what terms?
  6. How do you disclose subprocessors and data locations?

Ask your own team: which of our cloud services hold personal data, and for each one, do we know who the processor is and where the data lives?

What should you ask a cloud provider about ISO/IEC 27017 and 27018?

Short version: ask for the certificate, the scope, the edition and the report, and ask what part of the responsibility split is yours. If a provider answers with a logo and a link to a general trust page, treat the claim as unverified. The AWS and Microsoft pages both give customers a route to the documents, which is the standard worth expecting.

Learn more

Key takeaways

  • ISO/IEC 27017 adds cloud security guidance for providers and customers; ISO/IEC 27018 adds personal data protection guidance for public cloud providers acting as PII processors.
  • ISO lists Edition 2 of 27017 (July 2026) and Edition 3 of 27018 (August 2025) as current, replacing the 2015 and 2019 editions.
  • Both build on ISO/IEC 27002 and are normally evidenced through an ISO/IEC 27001 audit; read the certificate to see how.
  • A provider's certificate does not certify you. You still own your configuration, access and data protection duties.
  • Ask for the certificate, scope, edition, certification body, statement of applicability and audit report.

Sources