02 / Compliance and certification
ISO/IEC 27017 and 27018, for the parts of security that live in the cloud
We help cloud providers and their customers extend an ISO/IEC 27001 ISMS with the cloud and PII controls these codes of practice describe, and show it to an auditor.
Overview
What the two standards cover
ISO/IEC 27017 is a code of practice for information security controls for cloud services. It adds cloud-specific guidance to the controls of ISO/IEC 27002, for both cloud service providers and cloud service customers, and is clear about who is responsible for what.
ISO/IEC 27018 is a code of practice for protecting personally identifiable information (PII) in public clouds, written for providers acting as PII processors. It covers topics such as following the customer's instructions, use of PII for marketing, disclosure, return and deletion, and transparency about subprocessors.
Neither is usually certified on its own. Certification bodies assess them as an extension of an ISO/IEC 27001 certification. Black Fox prepares you for that audit, coordinates it with our long-standing certification partners or your current certification body, and supports you during it; the certificate comes from the certification body.
Who it is for
SaaS, platform and infrastructure providers whose customers ask how their data is protected in the cloud, providers processing personal data on behalf of customers, and organisations that already hold or are working towards ISO/IEC 27001 and want the cloud to be visibly part of it.
The work, from scoping to evidence.
What we do
Shared responsibility
We map which controls sit with you, with your cloud provider and with your customers, so nothing falls between two contracts.
Gap assessment
A review of your ISMS and cloud operations against the additional guidance in both standards, with findings ranked by risk and effort.
Cloud controls
Controls for tenant separation, virtual environment hardening, administrator operations, monitoring and the return of customer assets.
PII processor controls
Procedures for customer instructions, disclosure requests, subprocessors, data location, return and deletion of PII.
Statement of Applicability and evidence
The extended controls added to your Statement of Applicability, each with a pointer to its evidence.
Technical checks
Where useful, a cloud security assessment of your actual configuration, so the documents and the tenant tell the same story.
How the engagement runs
Kickoff
We agree the services in scope, your role as provider, customer or both, and the deadline. An NDA comes first if you need one.
Gap assessment
Interviews, document review and a look at the cloud environment, ending in a prioritised gap report.
Implementation support
We work with your owners on controls, contracts, customer documentation and evidence.
Internal audit
An internal audit covering the ISO/IEC 27001 scope and the extended controls.
Certification audit
We coordinate the assessment of the extension with one of our long-standing certification partners or the body that already certifies you, help you prepare and help with any findings that follow.
What you receive
- Shared responsibility matrix for the services in scope
- Gap assessment report with a prioritised action plan
- Extended Statement of Applicability with evidence references
- Cloud and PII processing procedures
- Customer-facing security and privacy information
- Internal audit report
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Can we certify against ISO/IEC 27017 or 27018 on their own?
Usually not. Both are codes of practice that extend ISO/IEC 27001 and 27002. Certification bodies assess them within or alongside an ISO/IEC 27001 certification, and the result is typically shown on or with that certificate.
We are a cloud customer, not a provider. Does 27017 apply?
It can. ISO/IEC 27017 gives guidance to cloud service customers as well as providers, for example on understanding the provider's controls and managing your side of the shared responsibility.
How does ISO/IEC 27018 relate to ISO/IEC 27701?
ISO/IEC 27018 focuses on public cloud providers acting as PII processors. ISO/IEC 27701 covers a privacy management system for controllers and processors in general. Many cloud providers look at both, and the work overlaps.
Do you issue the certificate?
No. The certification body that audits your ISO/IEC 27001 scope assesses the extension. We prepare you, coordinate the audit with one of our long-standing certification partners or the body you already use, and support you through it.
Related services
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Compliance and certificationISO/IEC 27701ISO/IEC 27701 support from Black Fox Security: PIMS scoping, controller and processor roles, privacy risk, records of processing and certification preparation.
- Compliance and certificationGDPRGDPR support from Black Fox Security: records of processing, DPIAs, security of processing, processor agreements, breach handling and data subject requests.
Show your customers how the cloud side is handled
Tell us which services you run and who holds which keys. We will show you where the gaps are.