In short
ISO 27017 adds cloud guidance and controls for providers and clients; ISO 27018 protects the personal data a public cloud provider processes as a processor.
The current editions are ISO/IEC 27017:2026 and ISO/IEC 27018:2025, both aligned with ISO/IEC 27002:2022.
They cannot be certified on their own: they are verified within the ISO 27001 certification, as a scope extension referenced in the SoA.
In the cloud, responsibilities are shared: write them into a matrix and the contract, including towards your IaaS provider.
27018 helps you meet Article 28 GDPR but does not replace the contract; for a standalone privacy certification you need ISO 27701.
Already ISO 27001 certified and selling a cloud service? The 27017 and 27018 extensions answer your clients' specific questions about security and personal data in the cloud. These are the questions an ISO 27001 certificate alone leaves open: who patches the server, where the data is stored, who your sub-processors are, what happens to the data when the contract ends.
ISO 27017 and ISO 27018 are two guidance standards in the ISO/IEC 27000 family designed specifically for the cloud. The first adds cloud-specific guidance and controls for those who provide and those who use cloud services. The second focuses on the personal data a public cloud provider processes on behalf of its clients. In this guide we look at the current editions, how they are checked during audits (not as standalone certifications), how responsibilities are split between provider and client, their relationship with the GDPR and ISO 27701, and the steps to extend your management system.
What are ISO 27017 and ISO 27018?
ISO/IEC 27017 and ISO/IEC 27018 are guidance standards that complement the ISO/IEC 27002 controls for the cloud. They do not contain management system requirements: those remain in ISO 27001. Their job is to tell you how to apply the controls when the service is delivered in the cloud, and which additional controls are needed for the risks typical of this model.
ISO/IEC 27017: security controls for cloud services
According to ISO's official page, ISO/IEC 27017 builds on ISO/IEC 27002 and adds cloud-specific guidance and additional controls for both the cloud service customer and the provider. Its stated aim is to manage the risks arising from the shared nature of cloud computing: infrastructure, operational activities and responsibilities are divided between several parties and, if nobody puts them in writing, gaps open up.
The standard applies to all deployment models: public, private and hybrid cloud. ISO notes that in a private cloud some controls need adapting, because the "provider" and the "customer" may be two functions of the same organisation, such as central IT and a business unit. For an SME selling subscription software or managed services, 27017 is the reference for answering questions such as: who manages vulnerabilities at which layer, how different clients' data is separated, how administrator activities are logged.
ISO/IEC 27018: personal data in the public cloud
ISO/IEC 27018 has a narrower scope. It covers the protection of personal data (PII, in ISO terminology) in public cloud services, when the provider acts as a data processor on behalf of its clients. It also builds on ISO/IEC 27002 and, according to ISO, covers personal data handled by the provider throughout its life cycle: collection, storage, processing, transmission and deletion.
ISO identifies as users the public cloud providers processing data on behalf of clients, but also organisations that need to assess a provider before entrusting it with personal data. If your platform hosts records of employees, patients or end customers of your clients, 27018 gives structure to the answers their DPO will ask you for.
ISO/IEC 27017 | ISO/IEC 27018 | |
|---|---|---|
Topic | Information security in cloud services | Protection of personal data in the public cloud |
Intended for | Cloud service providers and customers | Public cloud providers acting as data processors |
Cloud models | Public, private and hybrid | Public cloud |
Basis | ISO/IEC 27002 controls plus additional cloud controls | ISO/IEC 27002 controls adapted to personal data in the cloud |
Certifiable on its own | No, checked within the ISO 27001 ISMS | No, checked within the ISO 27001 ISMS |
What are the current editions of ISO 27017 and ISO 27018?
Both standards have been revised to align with ISO/IEC 27002:2022. The ISO catalogue lists ISO/IEC 27017:2026 (second edition) as the published version, replacing the first edition from 2015. For ISO 27018 the current version is ISO/IEC 27018:2025, the third edition, which replaced the 2019 one.
What alignment with ISO 27002:2022 changes
The practical point is consistency. The previous editions referred to the old ISO 27002 control structure, while your Statement of Applicability (SoA) now follows Annex A of ISO/IEC 27001:2022. With the new editions the numbering lines up again between the SoA and the cloud controls, making it easier to integrate the two guidance standards without hand-made conversion tables. ISO also notes that 27018:2025 includes a new Annex B with extended implementation guidance.
What to do if your certificate cites the previous editions
If your ISO 27001 certificate already refers to 27017:2015 or 27018:2019, you do not need to start over. In Italy, Accredia technical circular DC no. 22/2026 states that certifications including 27017 and 27018 remain valid until expiry or until the first relevant change, such as an extension or a change of scope. From that point they must be brought in line with the new rules. It therefore makes sense to plan the SoA update to the new editions ahead of renewal, rather than discovering it during the audit.
Why do clients ask for ISO 27017 and 27018 if you already have ISO 27001?
Because ISO 27001 certifies that you have an information security management system, not that you have resolved the issues typical of the cloud. A client entrusting you with data and processes wants to know where your responsibility ends and theirs begins, and whether their users' personal data is processed according to their instructions.
The typical case: a software house selling SaaS
Picture a 35-person company selling HR management software as SaaS. The software runs on a large IaaS provider's infrastructure, and the company holds ISO 27001 covering the whole development and delivery of the service. A new client, a group with 2,000 employees, sends its questionnaire: it asks who patches the operating system, whether its employees' data is separated from other clients' data, in which countries backups are stored, how quickly it will be notified of a breach and how data is deleted at the end of the contract.
The ISO 27001 certificate does not directly answer any of these questions. A system extended to the 27017 and 27018 guidelines does, because it requires the company to have already defined, documented and verified those answers. If you often receive similar requests, you will find a method for organising them in the guide to customer security questionnaires.
The GDPR asks for "sufficient guarantees"
When a client entrusts you with personal data, under the GDPR they are the controller and you are the processor. Article 28(1) of the Regulation says the controller shall use only processors providing sufficient guarantees of appropriate technical and organisational measures. That is why the client's procurement team and DPO insist: they must be able to show they chose a suitable supplier. The 27017 and 27018 extensions, verified by a certification body, are a structured way of offering those guarantees, although, as we will see, they do not replace the contract.
How do you get certified for ISO 27017 and ISO 27018?
There is no standalone accredited ISO 27017 or ISO 27018 certificate. The two standards are guidelines: their application is verified within the ISO 27001 certification, as an extension of scope. The certificate continues to attest conformity with ISO 27001 only.
What the accreditation rules say
Accredia circular DC no. 22/2026 is explicit. It classifies 27017 and 27018 among the "Type B" standards or guidelines of the 27000 family, useful for identifying the operational controls of the management system, and states that they are not certifiable. However, if the organisation can demonstrate it has applied them correctly, the certification body must verify those controls.
The same circular requires the scope extension audit to include additional audit time: at least one extra auditor day for each additional standard applied, for every audit and at any stage. This is useful for planning, not only for the certification body: it means 27017 and 27018 are checked at every surveillance audit, not just once.
What appears on the certificate
The certification scope must refer to the Statement of Applicability, its revision and the guidelines used for the controls. The example given by Accredia reads along these lines: SaaS services delivered according to the SoA, revision and date, supplemented by the controls set out in the ISO/IEC 27017 and ISO/IEC 27018 guidelines. Only Type A standards, namely ISO/IEC 27001 and ISO/IEC 27701, appear in the certification database, while the other standards in the series are shown in the scope description.
This has a concrete commercial consequence for you. In your sales materials, do not write "ISO 27018 certified": the correct wording is ISO 27001 certification with scope extended to the controls of the 27017 and 27018 guidelines. That is exactly what an experienced client will check when reading the certificate. If you want to revisit how the basic process works, start with the complete guide to ISO 27001.
Shared responsibility: who does what between provider and client?
In the cloud, security is always shared, but the split changes with the type of service. 27017 exists precisely to make the division explicit between client and provider, so that no control is left uncovered because each side assumed the other was handling it.
How the split changes across IaaS, PaaS and SaaS
The general rule is simple: the "higher" the service sits in the technology stack, the more responsibility moves to the provider. The table is an example of a typical split, to be adapted to your service and written into the contract and client documentation.
Activity | IaaS | PaaS | SaaS |
|---|---|---|---|
Physical data centre security | Provider | Provider | Provider |
Operating system patching | Client | Provider | Provider |
Application configuration and updates | Client | Client | Provider |
User and permission management | Client | Client | Client, with provider tools |
Classification of uploaded data | Client | Client | Client |
Data backup | To be defined in the contract | To be defined in the contract | To be defined in the contract |
The last row causes the most misunderstandings. Many clients assume the provider keeps restorable backups of everything, while many providers only guarantee infrastructure continuity. Writing it down explicitly avoids the worst problem: finding out who was supposed to do what the day after an incident.
You are provider and client at the same time
An SME selling SaaS is almost always also a client of a larger provider for its infrastructure. This means you must apply 27017 on both sides: as a provider towards your clients and as a client towards your IaaS or PaaS provider. What you promise your clients must be consistent with the guarantees you obtain from your suppliers.
Here too the Accredia circular offers useful guidance: the certification body must verify how you ensure the security of the infrastructure you use, including cloud infrastructure. If external services are covered by accredited certificates under EA/MLA, these count as a presumption of conformity; otherwise the certification body must audit the specific site. In practice: keep your providers' certificates, check that their scope covers the services you actually use and update your assessment when they change.
ISO 27018, GDPR and ISO 27701: how do they fit together?
ISO 27018 is a tool for demonstrating how you protect personal data in the cloud, but it is not a GDPR certification. The Regulation recognises, as an element for demonstrating a processor's guarantees, adherence to an approved code of conduct or an approved certification mechanism under Article 42 (Article 28(5)): an ISO 27001 certification extended to 27018 does not fall into this category.
The Article 28 obligations 27018 helps you cover
Article 28(3) of the GDPR lists what the contract with the processor must stipulate. The commitments include processing only on documented instructions from the controller, including for transfers to third countries, confidentiality of authorised persons, the measures required by Article 32, assisting the controller with data subjects' rights and deleting or returning the data at the end of the service. The processor must also make available the information necessary and allow for audits, including inspections. Paragraph 2 prohibits engaging another processor without the controller's written authorisation, and Article 33(2) requires notifying the controller without undue delay after becoming aware of a breach.
A system extended to 27018 forces you to turn these commitments into verifiable practice: an up-to-date list of sub-processors, a tested deletion procedure, a breach notification flow with defined internal timescales. The contract remains essential: the standard helps you comply with it and demonstrate compliance, it does not replace it.
When you also need ISO 27701
ISO/IEC 27701:2025 is something else: it is a privacy information management system (PIMS) with its own requirements, designed for controllers and processors. ISO describes it as an independent management system standard that can be used on its own, and Accredia lists it as a Type A standard, certifiable independently. 27018 only covers the processor role in the public cloud; 27701 covers the whole management of personal data, including data you process as a controller, such as your employees' data or your sales leads.
Many SaaS providers combine the three standards: ISO 27001 as the foundation, 27017 and 27018 in the SoA, and 27701 when clients ask for a privacy certification in its own right. If you are considering this route, the guide to ISO 27701 and privacy information management explains the requirements and integration with 27001.
How do you extend your ISO 27001 system to 27017 and 27018?
The extension does not require a second management system. You work on the tools you already have, in particular scope, risk assessment and SoA, and add the cloud-specific evidence. These are the steps, in the order in which it makes sense to tackle them.
Check the scope: the certificate scope must include the cloud service you sell, with the sites, processes and infrastructure that deliver it.
Update the risk assessment: add the risks typical of the cloud, such as separation between clients, administrative access, dependence on the IaaS provider and data location.
Supplement the SoA: for each applicable 27017 and 27018 control, state whether you apply it, how and with what evidence, or why you exclude it.
Align contracts and client documentation: responsibility matrix, data processing agreement, list of sub-processors, end-of-contract procedure.
Gather the evidence: administrative access logs, restore tests, proof of deletion, supplier checks, breach register.
Run the internal audit on the new scope, then ask the certification body for the scope extension, usually at a surveillance audit or at renewal.
The evidence the auditor will ask for
The auditor will not settle for a written procedure: they want to see it working. For 27017, expect to show how you separate client data, how you log and monitor administrator activities and how you inform clients of changes that affect them. For 27018, you will be asked how you process data only according to the client's instructions, how you manage sub-processors and how you prove deletion at the end of the contract. Prepare real examples, not empty templates: a closed deletion request ticket, an exported access log, a restore test record.
The internal audit before the extension
The internal audit on the extended scope is when you find out whether the evidence holds up. It must cover the controls added to the SoA, not only those verified in previous years, and be carried out by someone impartial towards the work being audited. If you want to understand how to organise it, you will find method and typical mistakes in the guide to ISO internal audits.
What are the most common mistakes with ISO 27017 and 27018?
The most frequent mistakes are not about technology but about how the extension is set up and communicated. The first is advertising a non-existent certification: writing "ISO 27017 certified" on your website when the certificate attests ISO 27001 with an extended scope.
The second is relying on the IaaS provider's certificate as if it were your own. The large provider certifies its infrastructure, not your application or the way you manage your administrators' access. Its certification covers its layer: you have to cover yours, and show you have assessed theirs.
The third mistake is treating sub-processors as a list to fill in once. Every new tool, from the email delivery service to the ticketing system, may process clients' personal data and requires authorisation and notification under Article 28(2) of the GDPR. A list that is a year out of date is a nonconformity waiting to be found.
The fourth is never testing the end of the contract. Everyone writes that data is deleted or returned, but few have actually tried it, backups included. Run at least one documented simulation: it is the evidence most often missing when the auditor asks for it.
How Complaion helps you with ISO 27017 and ISO 27018
With Complaion you extend your ISO 27001 system to the cloud starting from what you already have. A dedicated Lead Auditor works with your company: they check that the scope genuinely includes the cloud service, help you supplement risks and SoA with the 27017 and 27018 controls, and propose the path best suited to your needs, including when it makes sense to add ISO 27701. The internal audit on the extended scope is carried out by your Complaion Lead Auditor, who does not audit their own operational work.
The Complaion platform collects your cloud evidence, from access logs to restore tests, manages documents such as the responsibility matrix and the sub-processor list, keeps the schedule of surveillance audits, renewals and reviews, and prepares the audit. The path with Complaion avoids nonconformities and leads to the external audit with a 100% success rate. We already work with more than 1,000 clients. Discover our services for ISO 27017 and ISO 27018, add our outsourced DPO if you need one, or contact us for a quote.
Frequently asked questions about ISO 27017 and ISO 27018
Can I get ISO 27017 certification without ISO 27001?
No. ISO 27017 is a guideline and cannot be certified on its own under accreditation. Its application is verified by the certification body within the ISO 27001 certification, as an extension of scope. The certificate attests conformity with ISO 27001 and refers to the 27017 controls in its scope.
What is the difference between ISO 27017 and ISO 27018?
ISO 27017 covers information security in cloud services and is aimed at both providers and clients, in any cloud model. ISO 27018 covers the protection of personal data in the public cloud when the provider acts as a data processor. Many SaaS providers apply both, because clients ask for guarantees on both fronts.
Which editions are current?
For ISO 27017 the current edition is the second, ISO/IEC 27017:2026, which replaced the 2015 one. For ISO 27018 the current edition is the third, ISO/IEC 27018:2025, which replaced the 2019 one. Both are aligned with ISO/IEC 27002:2022, and therefore with the control structure of Annex A of ISO 27001:2022.
Does ISO 27018 make my service GDPR compliant?
No, but it helps you demonstrate the guarantees the GDPR requires of a processor. The Regulation recognises approved codes of conduct and approved certification mechanisms under Article 42 as evidence of those guarantees, and ISO 27018 is not one of them. The data processing contract required by Article 28 remains mandatory.
Do I need ISO 27701 if I already have ISO 27018?
It depends on what your clients ask for and what data you process. ISO 27018 only covers the processor role in the public cloud, while ISO 27701 is a complete privacy management system, certifiable on its own, that also covers processing where you are the controller. If clients ask for an explicit privacy certification, 27701 is the most suitable answer.
I use a large certified IaaS provider: is their certificate enough?
No. The provider's certificate covers its infrastructure and the services included in its scope, not your application or your organisation. You need it to assess the supplier and, if it is accredited, the certification body can treat it as a presumption of conformity for that part. The layers you manage still have to be covered by your own controls.
How much extra audit time do 27017 and 27018 require?
In Italy, Accredia circular DC no. 22/2026 requires at least one additional auditor day for each additional standard applied, for every audit and at any stage, net of applicable reductions. The total time depends on the scope and size of the organisation. To find out how it affects your case, it is best to start from a scope analysis and a quote.
