Standards · Cloud computing

ISO/IEC 27017 e 27018 Information security controls and PII protection for cloud services

PublishedPaid · 27 July 2026

Standards are protected by copyright and almost always sold: here you find metadata, an original summary and a link to the official catalogue page where they can be consulted or bought. The text is not reproduced.

Summary

The two standards tailor the ISO/IEC 27002 controls to the cloud. ISO/IEC 27017 guides cloud service providers and customers on shared responsibilities, tenant separation, management of virtual environments, and service administration and monitoring. ISO/IEC 27018 concerns public cloud providers processing personal data on behalf of customers: transparency, using data only as instructed, sub-processor management, return and deletion of data, and breach notification. They are often certified together with ISO/IEC 27001.

Reference

ISO/IEC 27017 e 27018

Official title

Information security controls and PII protection for cloud services

Body

ISO / IEC – Technical committee: ISO/IEC JTC 1/SC 27

Type

Series of standards

Status

Published

Published

27 July 2026

Access to the text

Paid

Sectors

• Cloud computing
• Data protection

Notes

ISO/IEC 27018:2025 (third edition, 26 August 2025) and ISO/IEC 27017:2026 (second edition, 27 July 2026) supersede the 2019 and 2015 editions and are aligned with ISO/IEC 27002:2022. The standards are published jointly by ISO and IEC; the link leads to the IEC catalogue.

Last verified

29 October 2026 (verified via web)

Metadata and summary: CC BY 4.0 · JSON

Report an error in this record (opens in a new tab)