ISO 27017 and 27018, cloud security and privacy controls
Extra controls for cloud providers and cloud customers, and for protecting personal data in the cloud.
Official sources
Use these official places to read the text and find the latest version.
Official website
ISO shows the edition and contents. ISO 27018 has its own page at iso.org/standard/27018.
Visit iso.org/standard/27017 (ISO 27017) ↗What ISO 27017 and 27018 is
ISO 27017 adds cloud-specific controls to ISO 27002 for providers and customers. ISO 27018 covers protecting personal data in public cloud services.
They are often added to an ISO 27001 certificate to show cloud maturity.
How ISO 27017 and 27018 got to where it is today
The milestones that changed what organisations have to do.
ISO/IEC 27018:2014
First code of practice for personal data in public clouds.
ISO/IEC 27017:2015
Cloud-specific security controls.
ISO/IEC 27018:2019
Updated edition.
ISO/IEC 27018:2025
Edition 3 is published.
ISO/IEC 27017:2026
Edition 2 is published in July 2026, aligned with the newer ISO 27002 controls.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
You provide a cloud or SaaS service.
You rely heavily on cloud platforms.
Customers ask about cloud security and privacy.
You hold ISO 27001 and want to add cloud assurance.
What it asks of you
The requirements fall into six areas.
Shared responsibility
Who does what between provider and customer.
Virtual environments
Isolate customers and workloads.
Customer data removal
Return and delete data when contracts end.
Monitoring and logging
Give customers visibility.
Personal data protection
Consent, purpose and use limits for personal data.
Transparency
Tell customers where data is and who has access.
2 standards, 5 areas and 25 controls
ISO/IEC 27017 adds cloud security guidance to the ISO/IEC 27002 control set. ISO/IEC 27018 adds controls for protecting personal data in public cloud. This page groups the key controls in plain words.
5 areas · 25 controls
c27017ISO/IEC 27017 cloud security controlsCloud specific guidance on top of the ISO/IEC 27002 controls, for providers and customers.2 areas · 13 controls
- CLD.6.3.1
Define who is responsible for what between cloud customer and provider.
What you do
- Agree a shared responsibility matrix in the contract
- Name contacts on both sides
- CLD.8.1.5
Return or remove customer assets when the service ends.
What you do
- Define exit and data return steps
- CLD.9.5.1
Keep each customer's virtual environment separate from others.
What you do
- Use tenant isolation and test it
- CLD.9.5.2
Harden virtual machines for the services they run.
What you do
- Use hardened images and disable unused services
- CLD.12.1.5
Protect administrator operations in the cloud.
What you do
- Document admin procedures and use privileged access controls
- CLD.12.4.5
Let customers monitor relevant cloud service activity.
What you do
- Provide logs and dashboards
- CLD.13.1.4
Align security of virtual and physical networks.
What you do
- Check virtual network configuration matches policy
Evidence to keep
- Shared responsibility matrix
- Customer asset return procedure
- Virtual machine hardening standard
- Admin procedures and monitoring records
- 27017-policy
Extend information security policy to cover cloud use and provision.
What you do
- Write a cloud policy for customers and providers
- 27017-supplier
Handle cloud supplier relationships and contracts securely.
What you do
- Assess cloud providers and record shared duties
- 27017-access
Control customer and provider access to cloud resources and keys.
What you do
- Use strong authentication and key management
- 27017-ops
Cover backup, change, logging and capacity in cloud operations.
What you do
- Agree backup and log arrangements in the contract
- 27017-incident
Agree how security incidents are reported between provider and customer.
What you do
- Set notification timelines and contacts
- 27017-legal
Know where data sits and what law applies, and keep evidence.
What you do
- Record data locations and compliance evidence
Evidence to keep
- Cloud security policy
- Supplier assessments
- Access and key records
- Incident procedures covering cloud
c27018ISO/IEC 27018 personal data in public cloudControls for public cloud providers acting as processors of personal data.3 areas · 12 controls
- 27018-instr
Process personal data only to meet the customer's instructions and not for your own marketing.
What you do
- Block secondary use in contracts
- 27018-help
Help customers respond to individuals exercising rights.
What you do
- Document a request support procedure
- 27018-disclose
Notify the customer of legally required disclosures and record all disclosures.
What you do
- Keep a disclosure log
- 27018-temp
Erase temporary files containing personal data promptly.
What you do
- Schedule automatic cleanup
Evidence to keep
- Processing agreements
- Disclosure log
- Temporary file deletion records
- 27018-sub
Tell customers about sub-contracted processing before it starts.
What you do
- Publish a sub-processor list and change notice
- 27018-loc
Tell customers the countries where personal data may be stored.
What you do
- Record and disclose data locations
Evidence to keep
- Sub-processor list
- Data location statement
- 27018-breach
Tell customers about personal data breaches and keep records.
What you do
- Set a breach notification procedure
- 27018-crypt
Encrypt personal data sent over public networks and on portable media.
What you do
- Enforce encryption in transit and at rest
- 27018-ids
Give each user a unique ID and keep records of authorised users.
What you do
- Review user lists regularly
- 27018-nda
Bind staff with confidentiality commitments.
What you do
- Include confidentiality in contracts
- 27018-disposal
Return, transfer or dispose of personal data securely on exit.
What you do
- Document disposal methods and keep certificates
- 27018-restore
Control and log restoration of data.
What you do
- Record restore requests and approvals
Evidence to keep
- Breach notices
- Encryption evidence
- User ID records
- Return and disposal records
Nothing matches. Clear the search or pick another standard.
Outcomes and implementation examples are from ISO/IEC 27017:2015 and ISO/IEC 27018:2019, published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Confirm your role
Provider, customer or both.
- 2
Map responsibilities
Between you and cloud suppliers.
- 3
Add the cloud controls
To your existing security system.
- 4
Gather evidence
Configs, logs, contracts.
- 5
Audit
Usually alongside ISO 27001.
How Optimus CyberX helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus CyberX |
|---|---|
| Shared responsibility | Responsibility matrix |
| Virtual environments | Configuration records |
| Customer data removal | Offboarding procedures |
| Monitoring and logging | Log reviews |
| Personal data protection | Privacy controls and records |
| Transparency | Transparency statements |
Free ISO 27017 and 27018 readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Shared responsibility matrix
- Cloud supplier checklist
- Data deletion procedure
- Cloud security checklist
Share or cite this page
Writing about ISO 27017 and 27018? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/iso-27017-27018/">ISO 27017 and 27018 explained in plain English - Optimus CyberX</a>Common questions
Do we need ISO 27001 first?
Normally yes. ISO 27001 is the base certificate, and the cloud standards extend it.
Which applies to us?
27017 for cloud security. 27018 if you handle personal data in the cloud.
Can we certify?
Usually as an extension of an ISO 27001 audit.
Is it a law?
No. They are voluntary international standards, though cloud customers often ask providers to show they follow them.
Related frameworks
See how ready you are for ISO 27017 and 27018
Answer questions across every area. We email you a report showing where you comply and where you do not.