If you run cloud services and your customers’ personal data sits on your systems, they’ll want to know you treat it carefully. Where is it stored, who can see it, what happens when they leave?
ISO/IEC 27018 sets out controls for public cloud providers acting as processors of personal data. We help you put them in place.
ISO/IEC 27018 is a code of practice that builds on ISO/IEC 27002, not a stand-alone management system standard. In practice, providers usually show conformity by adding its controls to an ISO 27001 certificate, and some certification bodies assess this as part of the audit.
Availability and wording vary by certification body, so we confirm with yours early, instead of promising a certificate that doesn’t exist.
ISO/IEC 27018:2025 is the current edition. It was published in August 2025, updated to match ISO/IEC 27002:2022, with an extra annex of implementation guidance.
It’s usually assessed alongside ISO 27001 instead of as a separate standalone certificate, though practice depends on the certification body.
In practice, yes. The two work together.
It’s written for processors, but controllers use it to judge their cloud suppliers.
If you already have ISO 27001, often two to three months.
Share your ISO 27001 status and we’ll tell you what ISO/IEC 27018 would add.