hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
Contact Sterling Academy login
SterlingInternational Consulting Talk to a consultantTalk to us
← All videos

Two-minute brief

ISO/IEC 27018 requirements explained: video brief

A two-minute brief on what ISO/IEC 27018:2025 contains and how its guidance becomes a commitment that can be assessed.

  • Two-minute brief
  • 2 min

Key takeaways

  • ISO/IEC 27018 is guidance; selected or contracted controls become assessable commitments.
  • It builds on the ISO/IEC 27002:2022 controls with cloud PII guidance.
  • Annex A follows the ISO/IEC 29100 privacy principles.
  • Customers' privacy questions on location, sub-processors and erasure are answered by the controls.
  • The 2025 edition replaced the withdrawn 2019 edition.

Guidance that becomes a commitment

ISO/IEC 27018 is a guidelines standard: every part of it, including Annex A, is guidance. What becomes a requirement is what an organisation commits to. Once a control is selected in the ISO/IEC 27001 risk treatment and recorded in the Statement of Applicability, or promised to a customer in a contract, the certification body assesses whether it exists and works. This short film shows that structure.

The standard sets out its layout first: each ISO/IEC 27002 control, the cloud PII guidance added to it, and the extended controls in Annex A. In practice the organisation starts with a statement of which services process personal data as a processor, for which customers, and which controls apply. The organisational controls of ISO/IEC 27002:2022 then carry cloud PII guidance where needed, covering policies and roles, supplier and cloud service relationships, incidents, legal and contractual requirements, and privacy and protection of personal data.

What the extended controls address

People, physical and technological controls follow the same pattern, with cloud PII guidance where a processor needs more than the base control. The extended control set in Annex A, organised in line with the ISO/IEC 29100 privacy principles, addresses what cloud customers' privacy offices ask about: processing only for the customer's purposes, transparency about data location and sub-processors, return, transfer and erasure of data, notice of personal data breaches, and handling of legally binding requests for disclosure.

The standard is written for SaaS, hosting, cloud storage and backup, platform and managed service providers that process personal data in the public cloud under contract. ISO/IEC 27018:2025, the third edition, was published in August 2025 and the 2019 edition is withdrawn. It is assessed alongside the ISO/IEC 27001 audit by an independent certification body and recorded on the certificate scope, a supplementary certificate or a statement of verification.

A hyperscaler's own record covers its services as a processor to the provider, not the provider's duties to its customers.

ISO/IEC 27018 at a glance

Purpose
Protecting the personally identifiable information (PII) a public cloud service processes for its customers: ISO/IEC 27002 controls with cloud guidance, plus an extended control set built on the ISO/IEC 29100 privacy principles
Relevant to
SaaS, hosting, cloud storage and backup, platform and managed service providers: any organisation processing personal data in the public cloud under contract, as a PII processor
Edition
ISO/IEC 27018:2025, third edition, published August 2025 and aligned with ISO/IEC 27002:2022; the 2019 edition is withdrawn
Certification
Guidelines, not a management system standard: assessed alongside your ISO/IEC 27001 audit by an independent certification body and recorded on the certificate scope, a supplementary certificate or a statement of verification
Sterling's role
Consulting with your team, Effivity, training, vulnerability assessment, internal audit and readiness, then Sustain™
Cost and timing
Total investment for ISO/IEC 27018 cloud privacy controls depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 2 to 5 months alongside an existing ISO/IEC 27001 system, or 4 to 8 months when both are built together

ISO/IEC 27018: the complete guide →

ISO/IEC 27018: questions people ask

Can we be certified to ISO/IEC 27018 on its own, or do we need ISO/IEC 27001?

Not on its own. ISO/IEC 27018 is a guidelines standard with no management system requirements, a reference for selecting PII protection controls inside an ISMS based on ISO/IEC 27001. Certification bodies assess its controls alongside the ISO/IEC 27001 audit and record the result on the certificate scope, on a supplementary certificate or in a statement of verification; some treat an ISO/IEC 27001 certificate as a prerequisite, and some also ask for the ISO/IEC 27017 cloud controls in the same audit. If you are already certified, the controls are added at the next surveillance or recertification audit or in a separate visit; if you hold neither, both are built together and assessed in the same Stage 1 and Stage 2.

What is the difference between ISO/IEC 27018 and ISO/IEC 27701?

ISO/IEC 27701:2025 is a certifiable management system standard for privacy, for PII controllers and processors of any kind. ISO/IEC 27018 is a control set for one role, the public cloud PII processor, applied inside an ISMS. A cloud provider often holds both: ISO/IEC 27018 answers the cloud contract; ISO/IEC 27701 governs privacy as a management system across everything it does.

And the difference between ISO/IEC 27018 and ISO/IEC 27017?

ISO/IEC 27017:2026 adds cloud-specific information security guidance and controls for cloud service customers and providers; ISO/IEC 27018 adds guidance and controls for the personal data a provider processes for its customers. They complement each other, many providers implement both, and some certification bodies assess them together.

Our platform runs on a hyperscaler that is itself ISO/IEC 27018 certified. Does that cover us?

No. Their record covers their services as a processor to you. Your customers contract with you, so the purpose, access, deletion, disclosure and notification controls for their data are yours to operate, and the hyperscaler is a sub-processor you disclose. You can rely on their assessed controls for the parts of the stack they run.

Does ISO/IEC 27018 make us GDPR compliant?

No standard does. ISO/IEC 27018 gives a recognised, independently assessed way to evidence the guarantees a controller must obtain from its processors: processing on instructions, sub-processor control, security, deletion or return of data and breach notification. Legal compliance remains a matter for your advisers; the record issued is not a compliance mark.

More ISO/IEC 27018 questions and answers →

Keep exploring

Related to this video

Read next

Services

Next steps

The complete guide

Everything on ISO/IEC 27018

Start with the ISO/IEC 27018 page, or go straight to the guide you need.

On the ISO/IEC 27018 page

Often combined with ISO/IEC 27018

More videos: Information security, cyber and cloud

All videos

Talk to a consultant

Plan your ISO/IEC 27018 certification with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Your goal
Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice