Passeca - Governance, Risk management, and Compliance support
Under attack?
ISO 27017 / ISO 27018

ISO 27017 / ISO 27018 Cloud Compliance

For cloud service providers needing cloud-security (27017) and PII-protection (27018) controls — certified as extensions to your ISO 27001 ISMS.

Book a free compliance consultationSee all frameworks

ISO/IEC 27017 is the code of practice for cloud-security controls and ISO/IEC 27018 protects PII in public clouds acting as processors. Both extend the ISO 27001 / 27002 control set. Passeca scopes your cloud service, implements the cloud-specific and PII controls, and certifies them as extensions to your existing ISO 27001 ISMS — building evidence once in Hyperproof.

Definition

What are ISO 27017 and ISO 27018?

ISO/IEC 27017 & 27018 — cloud security & PII

ISO/IEC 27017:2026 is a code of practice for information-security controls based on ISO/IEC 27002, with additional guidance specific to the provision and use of cloud services. It addresses controls relevant to both cloud service providers and cloud customers, including shared responsibilities between them.

ISO/IEC 27018:2025 provides guidelines for the protection of personally identifiable information (PII) in public clouds acting as PII processors. It builds on ISO/IEC 27001 and 27002 and adds controls addressing the unique risks of processing PII in a public cloud — including lawful basis, data return and deletion, disclosure of sub-processors, and breach notification to the controller. Both are normally certified as extensions to an existing ISO 27001 certificate, not as standalone certifications.

Scope

Who needs ISO 27017 / 27018?

  • You are a cloud service provider. IaaS, PaaS or SaaS providers needing to demonstrate cloud-specific controls to customers.
  • You process customer PII in a public cloud. ISO 27018 gives controllers confidence in your processor controls.
  • Enterprise customers ask about tenant separation. ISO 27017's cloud controls address it explicitly.
  • You already have ISO 27001. Adding the extensions is the most efficient way to extend assurance to your cloud service.
Requirements

What do ISO 27017 / 27018 actually require?

Both standards extend the ISO/IEC 27002 control set with cloud-specific additions. ISO 27017 adds controls relevant to the cloud service model and the shared responsibilities between provider and customer; ISO 27018 adds controls for the protection of PII processed by a public cloud acting as a processor.

ISO 27017 — cloud-security additions:

  • Shared responsibilities — clearly allocating security duties between provider and customer.
  • Tenant separation — logical isolation of customer data and environments.
  • Virtual machine hardening — secure configuration of virtualised environments.
  • Cloud monitoring and logging — visibility across the shared infrastructure.
  • Alignment of security management for cloud and on-premises environments.

ISO 27018 — PII in public clouds:

  • Lawful basis and consent — processing PII only on a documented, lawful basis.
  • Data return, transfer and deletion — clear obligations when a customer relationship ends.
  • Sub-processor disclosure — transparency about who processes PII on the provider's behalf.
  • PII breach notification — to the controller, enabling the controller's own obligations.
  • Marketing and advertising restrictions — PII must not be used for marketing without consent.
The engagement

How Passeca supports your ISO 27017 / 27018 assessment

  1. 01

    Cloud-scope definition

    We define your cloud service model (IaaS, PaaS or SaaS), the shared-responsibility split with your customers, and the in-scope PII — the foundation for which of the two standards, or both, apply.

  2. 02

    Gap analysis

    We assess your service against the ISO 27017 cloud-security controls and the ISO 27018 PII controls, identifying where your existing ISO 27001 ISMS already covers a control and where cloud-specific controls are missing.

  3. 03

    Remediation roadmap

    We prioritise the gaps — tenant separation, customer-data return and deletion, sub-processor management, and PII-specific rights — and build a sequenced plan with owners and dates.

  4. 04

    Implementation & evidence

    We implement the missing controls and capture evidence in Hyperproof, mapped so the same evidence serves your ISO 27001 ISMS and, where relevant, BSI C5 and SOC 2.

  5. 05

    Certification audit

    We introduce you to an accredited certification body, support the audit, and manage the response to any findings. ISO 27017 and 27018 are typically certified as extensions to your ISO 27001 certificate.

Deliverables

What you get from the engagement

A cloud-scope definition and shared-responsibility model
A gap analysis against ISO 27017 and 27018 controls
Implemented tenant-separation and virtualisation controls
PII handling controls — return, transfer and deletion
Sub-processor disclosure and management documentation
PII-breach notification process to controllers
Evidence pack in Hyperproof mapped to both standards and your ISO 27001 ISMS
Extension to your ISO 27001 certificate for 27017 and 27018
Timeline

How long does ISO 27017 / 27018 certification take?

Starting pointTypical durationWhat drives it
Existing ISO 27001 certificate2–4 monthsClosing cloud / PII controls + combined audit
ISO 27001 in progress3–6 monthsBuild baseline and extensions together
No ISO 27001 yet8–14 monthsBuild the ISMS first, then extend

The extensions are most efficient when added to an existing ISO 27001 surveillance or recertification cycle — one combined audit covers all three standards. If you do not yet hold ISO 27001, start there and add the cloud extensions during the same engagement.

Cost

How much does ISO 27017 / 27018 certification cost?

Because the cloud and PII extensions are typically certified alongside an existing ISO 27001 audit, the certification-body fee is incremental. Passeca's consulting covers the cloud-specific and PII control implementation on top of the ISMS.

ScopeConsulting (Passeca)Certification-body fee
27017 onlyPrice on requestQuoted separately by the certification body
27018 onlyPrice on requestQuoted separately by the certification body
Both (combined)Price on requestQuoted separately by the certification body
Overlap

Doing more than one framework?

 ISO 27017 / 27018ISO 27001BSI C5
ISMS management systemExtensionBaseline
Access control
Tenant separationGenericExplicit
PII handling / deletion27018GenericResidency
Sub-processor disclosure27018SupplierSupplier
AudienceCloud providersGlobalDE public sector

ISO 27017 / 27018, ISO 27001 and BSI C5 share a large control core. A cloud provider serving global enterprise and German public-sector buyers can build the evidence once in Hyperproof and certify across all three — the highest-leverage multi-framework combination in the cloud-provider segment.

FAQ

ISO 27017 / 27018, answered

The questions cloud providers ask about the cloud and PII extensions.

What are ISO 27017 and ISO 27018?
ISO/IEC 27017 is a code of practice for information-security controls based on ISO/IEC 27002, adding cloud-specific guidance for cloud service providers and customers. ISO/IEC 27018 is a code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors. Both extend the ISO 27001 / 27002 control set.
Who needs ISO 27017 or ISO 27018?
Cloud service providers — IaaS, PaaS and SaaS — that need to demonstrate cloud-specific security controls to customers (ISO 27017), and public-cloud providers acting as PII processors handling customer personal data (ISO 27018). They are commonly sought by providers serving enterprise, regulated or privacy-sensitive buyers.
Do ISO 27017 and ISO 27018 replace ISO 27001?
No. They are sector-specific extensions of ISO/IEC 27002, not standalone standards. They are normally certified as extensions to an existing ISO 27001 certificate — you add the cloud and PII controls on top of your ISMS rather than building a separate management system.
What is the difference between ISO 27017 and ISO 27018?
ISO 27017 adds cloud-specific security controls for both providers and customers (tenant separation, shared-responsibility, virtual machine hardening). ISO 27018 focuses specifically on the protection of PII in public clouds acting as processors — lawful basis, data return and deletion, sub-processor disclosure, and breach notification to the controller.
How long does ISO 27017 / 27018 certification take?
If you already hold ISO 27001 certification, adding the cloud and PII extensions typically takes 2–4 months of gap closure and a combined surveillance audit. Without an existing ISMS, build the ISO 27001 baseline first (see our ISO 27001 page) and add the extensions during or after.
How does ISO 27018 relate to the GDPR?
ISO 27018 helps demonstrate that a public-cloud processor protects PII to a recognised standard, which supports GDPR Article 32 (security of processing) for processors. It is not a substitute for GDPR compliance — you still need lawful basis, RoPA, DPIAs and data-subject rights — but it strengthens the processor's position.
How much does ISO 27017 / 27018 certification cost?
The cloud and PII extensions are usually certified alongside an existing ISO 27001 surveillance or recertification audit, so the additional certification-body fee is incremental. The largest effort component is the cloud-specific control implementation.
Can we certify ISO 27017 and ISO 27018 together?
Yes, and most cloud providers do. Because both extend the same ISO 27002 control set and share the same audit, certifying them together in a single extended-scope audit is the most efficient path. Passeca implements both control sets concurrently.
Always-on defence

Certify your cloud service beyond the ISO 27001 baseline

Book a free compliance consultation. We will confirm whether you need 27017, 27018, or both, and give you a timeline and cost band — usually as an extension to your existing ISO 27001 audit.

Book a free consultationSee ISO 27001

Related

Compliance hubAll 11 frameworks in one placeISO 27001 CertificationThe base ISMS the extensions sit onBSI C5 ComplianceGerman public-sector cloud controlsGDPR ComplianceThe PII regime 27018 supportsCloud Security (Wiz)Cloud posture and workload securitySaaS & technologyThe Passeca bundle for SaaS vendorsBook a consultationFree 30-minute compliance consultation