ISO 27017 & ISO 27018 — Cloud Security and Cloud Privacy Controls
ISO 27017 adds cloud-specific security controls and clarifies shared responsibility between cloud provider and customer; ISO 27018 protects personal data in public clouds. Both are typically assessed as part of an ISO 27001 certification.
For SaaS and cloud providers selling to enterprises, they answer the questions buyers always ask about cloud security and privacy. Mutex Systems adds them to your ISMS without a second management system.
- Category
- Compliance Framework
- Jurisdiction
- International
- Issuing Body
- ISO / IEC
- Current Version
- ISO/IEC 27017:2015 and ISO/IEC 27018
- Who It's For
- SaaS, PaaS and IaaS providers, managed service providers and organisations running sensitive workloads in public cloud.
Core Domains
A Practical Compliance Path
- 01
Responsibility matrix
Define which controls the provider and the customer own.
- 02
Gap analysis
Assess against 27017 and 27018 controls on top of ISO 27001.
- 03
Implement
Close gaps in cloud configuration, logging and PII handling.
- 04
Certify
Include in your ISO 27001 audit scope.
Cloud controls checked in the cloud
We verify cloud configuration technically, not just on paper, using our cloud security and penetration testing practice.
- Shared-responsibility matrix
- Cloud configuration review
- Cloud penetration testing
Cloud controls inside your ISO 27001
grComply carries 27017 and 27018 cross-mapped into your ISO 27001 ISMS, with a shared-responsibility matrix and PII controls evidenced in one tree.
- Shared-responsibility matrix
- Cloud and PII controls as one tree
- Cross-mapping to 27001 and 27701
- Evidence for cloud audits
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About ISO 27017 & 27018
Can you certify to ISO 27017 alone?
ISO 27017 and 27018 are codes of practice. They are normally assessed as an extension of an ISO 27001 certification rather than as standalone certificates.
Who needs ISO 27018?
Public cloud providers acting as processors of personal data, and SaaS companies whose customers need assurance about how their personal data is handled in the cloud.
Ready to Start Your ISO 27017 & 27018 Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.