ISO 27017 and ISO 27018: Cloud Security and Privacy Extensions to 27001

27017 focus

Clarifies cloud customer vs provider responsibilities for securing cloud services.

27018 focus

PII processor controls for public cloud — consent, return/deletion, disclosure transparency themes.

Alongside CSA CCM

See also CCM vs ISO 27017/27018 for crosswalk strategy.

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Must we certify both?

Market-driven; many cloud sellers pursue them for procurement.

Relation to 27701?

27701 is PIMS; 27018 is cloud PII processor practice.

Customers still responsible?

Yes for their configurations and data.

Related Resources

• CCM comparison
• ISO hub