Get audit-ready for ISO 27017/18
ISO 27017/27018 · Cloud Security and Privacy Controls
Code of practice for information security controls and PII protection in public cloud computing environments, extending ISO 27002 with cloud-specific guidance.
ISO 27017/18What is ISO 27017/18?
Code of practice for information security controls and PII protection in public cloud computing environments, extending ISO 27002 with cloud-specific guidance.
Who it applies to
Cloud service providers and cloud customers asked to evidence cloud-specific controls. Commonly requested of SaaS vendors by enterprise procurement alongside ISO 27001 itself.
How the standard is organised
Two codes of practice rather than a management system: 27017 covers cloud security controls for providers and customers, 27018 covers protection of personal data in public cloud.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
ISO 27017/18 on the Bitkosh platform
The 66 ISO 27017/18 controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- 27018 A.1.1Obligation to co-operate regarding PII principals' rights
Give customers the means to meet their duty to individuals who exercise access, correction or erasure rights over their personal data.
PII consent & choice - 27018 A.10.2Restriction of the creation of hardcopy material
Limit the printing or copying of personal data to paper to what is strictly necessary.
PII operational security - 27017 18.1.1Identification of applicable legislation and contractual requirements (cloud)
Identify laws that apply to the cloud service, including those of the provider's and customer's countries and of data locations.
Legal compliance & records - 27018 A.10.6Encryption of PII transmitted over public data-transmission networks
Encrypt personal data sent across public networks.
PII operational security - 27018 A.11.2Intended destination of PII
Protect personal data sent between locations so it reaches only the intended destination, and so transfers can be traced.
PII location & compliance - 27018 A.2.2Public cloud PII processor's commercial use
Do not use customer personal data for marketing or advertising without explicit consent that is not made a condition of service.
PII use & purpose limitation
More information security & cybersecurity frameworks
Frequently Asked Questions
Who publishes ISO 27017/18, and who does it apply to?
How is ISO 27017/18 conformance demonstrated?
How is ISO 27017/18 structured?
Ready to get audit-ready for ISO 27017/18?
See how the Bitkosh Readiness Platform gets you audit-ready for ISO 27017/18 — and the other 47 ready frameworks — from a single control library.