Use ISO/IEC 27017 for cloud security responsibilities and ISO/IEC 27018:2025 when a public cloud provider processes PII for a customer.
The standards complement each other. Neither replaces applicable privacy law, the controller's duties, the processing contract, or service-specific risk assessment.
Structured answer sets in this page tree.
Cited legal and guidance references.
ISO/IEC 27017:2015 covers cloud information security for providers and customers. ISO/IEC 27018:2025 covers protection of personally identifiable information (PII) in public cloud services when the provider acts as a . Apply ISO/IEC 27017 to the service's broader cloud security boundary and add ISO/IEC 27018 only where the public-cloud, PII, and processor conditions are met.
Compare the service scope, actor test, control focus, evidence, and limits of reuse between the two standards.
Cloud information security guidance for providers and customers across the provision and use of cloud services.
PII protection guidance for public cloud providers acting as PII processors, with privacy-specific controls and implementation guidance.
| Dimension | ISO/IEC 27017 | ISO/IEC 27018 | Operational implication |
|---|---|---|---|
| Scope and covered activity | ISO/IEC 27017 gives cloud-specific security control guidance for cloud service providers and cloud service customers. | ISO/IEC 27018:2025 applies to protection of PII in public cloud services when the cloud service provider acts as a . | Apply ISO/IEC 27017 broadly to cloud security. Add ISO/IEC 27018 only after documenting the public-cloud, PII, and processor conditions. |
| Who must act | The cloud service provider and cloud service customer each receive guidance; their actions depend on the agreed security responsibility allocation and service model. | The public cloud provider is the and the cloud customer is normally the party giving processing instructions. Controller duties and any provider processing for its own purposes need separate analysis. | Record roles by processing purpose and service. One organization can act as processor for one activity and controller for another. |
| Trigger or threshold | ISO/IEC 27017 is relevant when an organization provides or uses a cloud service and adopts its cloud-specific security guidance. | ISO/IEC 27018 becomes relevant when a public cloud provider processes PII on behalf of a customer as a . | The presence of PII alone does not decide scope. Confirm the deployment model and role before assigning ISO/IEC 27018 controls. |
| Core obligations | ISO/IEC 27017 covers broader cloud security topics such as responsibility allocation, customer assets, administrative operations, monitoring, change, virtual environments, and network alignment. | ISO/IEC 27018 adds privacy guidance for public-cloud processor activities, including support for PII principals' rights, instructions, disclosures, transfers, return or deletion, and PII breach handling. | Maintain one integrated control plan but preserve the source and owner for every security and privacy outcome. |
| Evidence and records | Evidence includes the service and responsibility scope, agreements, provider assurance, customer configurations, access reviews, logs, backup tests, vulnerability records, change notices, and incident records. | Evidence adds the processing and role record, instructions, PII location and transfer records, subprocessors, disclosures, assistance requests, deletion or return results, and PII breach records. | Reuse a record only when it covers the correct entity, service, role, PII, location, control, period, and exception status. |
| Timing and cadence | ISO/IEC 27017 review timing follows service selection, risk, architecture, supplier, contract, incident, audit, and service-change cycles. | ISO/IEC 27018 review timing also follows changes in processing purpose, PII, processor role, public-cloud status, location, subprocessors, and the privacy contract. | Neither standard sets one universal compliance deadline. Track framework editions, contract dates, assurance periods, and legal deadlines separately. |
| Assurance and legal effect | ISO/IEC 27017 can support an ISO/IEC 27001 control environment, certification scope, internal audit, contract, or customer assurance, but it is not legislation or a standalone certification scheme. | ISO/IEC 27018 can support privacy control design and assurance for its stated scope, but it does not replace binding privacy law or decide controller and processor roles. | State the exact certification, audit, contract, or legal claim. Do not present adoption of either guidance standard as automatic legal compliance. |
| Overlap and reuse | Security records under ISO/IEC 27017 can support overlapping ISO/IEC 27018 controls, including access, logging, incident, supplier, and deletion-related evidence. | ISO/IEC 27018 still requires evidence for its narrower processor and PII outcomes that a general cloud security record may not cover. | Link shared evidence once, then list the privacy-specific gap and owner rather than claiming the two control sets are equivalent. |
| Practical decision rule | Use ISO/IEC 27017 for the cloud service's security responsibility and control model. | Add ISO/IEC 27018:2025 for public-cloud PII processing performed by the provider as processor. | If ISO/IEC 27018 does not apply, keep the privacy analysis under the relevant law, contract, and other applicable standards rather than forcing this control set onto the service. |
ISO/IEC 27017 gives cloud-specific security control guidance for cloud service providers and cloud service customers.
ISO/IEC 27018:2025 applies to protection of PII in public cloud services when the cloud service provider acts as a .
Apply ISO/IEC 27017 broadly to cloud security. Add ISO/IEC 27018 only after documenting the public-cloud, PII, and processor conditions.
The cloud service provider and cloud service customer each receive guidance; their actions depend on the agreed security responsibility allocation and service model.
The public cloud provider is the and the cloud customer is normally the party giving processing instructions. Controller duties and any provider processing for its own purposes need separate analysis.
Record roles by processing purpose and service. One organization can act as processor for one activity and controller for another.
ISO/IEC 27017 is relevant when an organization provides or uses a cloud service and adopts its cloud-specific security guidance.
ISO/IEC 27018 becomes relevant when a public cloud provider processes PII on behalf of a customer as a .
The presence of PII alone does not decide scope. Confirm the deployment model and role before assigning ISO/IEC 27018 controls.
ISO/IEC 27017 covers broader cloud security topics such as responsibility allocation, customer assets, administrative operations, monitoring, change, virtual environments, and network alignment.
ISO/IEC 27018 adds privacy guidance for public-cloud processor activities, including support for PII principals' rights, instructions, disclosures, transfers, return or deletion, and PII breach handling.
Maintain one integrated control plan but preserve the source and owner for every security and privacy outcome.
Evidence includes the service and responsibility scope, agreements, provider assurance, customer configurations, access reviews, logs, backup tests, vulnerability records, change notices, and incident records.
Evidence adds the processing and role record, instructions, PII location and transfer records, subprocessors, disclosures, assistance requests, deletion or return results, and PII breach records.
Reuse a record only when it covers the correct entity, service, role, PII, location, control, period, and exception status.
ISO/IEC 27017 review timing follows service selection, risk, architecture, supplier, contract, incident, audit, and service-change cycles.
ISO/IEC 27018 review timing also follows changes in processing purpose, PII, processor role, public-cloud status, location, subprocessors, and the privacy contract.
Neither standard sets one universal compliance deadline. Track framework editions, contract dates, assurance periods, and legal deadlines separately.
ISO/IEC 27017 can support an ISO/IEC 27001 control environment, certification scope, internal audit, contract, or customer assurance, but it is not legislation or a standalone certification scheme.
ISO/IEC 27018 can support privacy control design and assurance for its stated scope, but it does not replace binding privacy law or decide controller and processor roles.
State the exact certification, audit, contract, or legal claim. Do not present adoption of either guidance standard as automatic legal compliance.
Security records under ISO/IEC 27017 can support overlapping ISO/IEC 27018 controls, including access, logging, incident, supplier, and deletion-related evidence.
ISO/IEC 27018 still requires evidence for its narrower processor and PII outcomes that a general cloud security record may not cover.
Link shared evidence once, then list the privacy-specific gap and owner rather than claiming the two control sets are equivalent.
Use ISO/IEC 27017 for the cloud service's security responsibility and control model.
Add ISO/IEC 27018:2025 for public-cloud PII processing performed by the provider as processor.
If ISO/IEC 27018 does not apply, keep the privacy analysis under the relevant law, contract, and other applicable standards rather than forcing this control set onto the service.
Use ISO/IEC 27017 for the security of providing and using a cloud service, whether the service is public, private, community, or hybrid and whether or not it processes PII. It addresses provider and customer responsibilities across the cloud service.
Add ISO/IEC 27018:2025 when the service is a public cloud, PII is processed, and the provider acts as a under contract to the customer. For example, a multi-tenant SaaS provider processing a customer's employee records only on that customer's instructions can meet those scope conditions. The same provider's separate use of account contact data for purposes it determines can place that activity outside the processor scope. A provider acting as a controller, or a private-cloud arrangement outside that scope, needs separate privacy analysis even if some guidance remains useful.
Record the standard edition and the organization's role for each service. ISO/IEC 27018:2019 was withdrawn when the 2025 third edition was published; the 2025 edition aligns with ISO/IEC 27002:2022 and adds extended implementation guidance in Annex B.
ISO/IEC 27017 evidence should show how provider and customer security duties work across the service. ISO/IEC 27018 evidence should additionally show the public-cloud scope and the privacy controls applied to processing on the customer's behalf.
Some records support both standards, such as the contract, access controls, incident records, deletion results, supplier information, and independent assurance. Reuse them only when the entity, service, role, data, location, control, period, and exception coverage match.
Assign owners, link shared evidence, and keep privacy-specific gaps and role decisions visible.
Create accountable tasks, evidence requests, and review checkpoints for both standards.
Review your current scope, evidence gaps, and next implementation steps.
First scope the cloud service and allocate security responsibilities under ISO/IEC 27017. Then identify PII, determine whether the service is public cloud, and document whether the provider acts as processor for the relevant processing.
Where ISO/IEC 27018 applies, add its privacy-specific control set and extended guidance. Map overlapping controls to shared evidence, but retain separate tasks for privacy purpose, instructions, disclosures, data-subject support, return or deletion, and other processor-specific outcomes.
Do not apply ISO/IEC 27018 to every cloud service merely because it stores account data. The scope depends on public-cloud processing of PII by a provider acting as processor. A service can contain several processing activities with different roles.
Do not treat ISO/IEC 27018 as a replacement for ISO/IEC 27017 or privacy law. It narrows the subject to public-cloud protection, while ISO/IEC 27017 covers broader cloud security and law supplies binding duties.
Review before onboarding and after changes to processing purpose, PII categories, controller or processor role, public-cloud status, region, subprocessor, service architecture, contract, or assurance scope. A PII breach or failed deletion test should trigger a targeted review.
For organizations moving from ISO/IEC 27018:2019, record how the 2025 edition's alignment with ISO/IEC 27002:2022 and extended implementation guidance affect the control map, evidence, and open remediation.
"Information security management systems — Requirements"
"Information security controls"
"Code of practice for information security controls based on ISO/IEC 27002 for cloud services"
"Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors"