In our digital age, data security is more crucial than ever before. As organisations adopt cloud solutions and remote work arrangements, protecting sensitive customer data becomes paramount. This is where information security standards like ISO 27001, ISO 27002, and ISO 27018 come into the picture. 📸
In particular, ISO 27018 outlines requirements for implementing controls to protect Personally Identifiable Information (PII) in public cloud environments. By leveraging ISO 27018 together with ISO 27001 and ISO 27002, companies can create robust data privacy programs suited for the cloud. 👍
Let’s break down the key aspects of ISO 27018 and how it complements core infosec standards:
📝 Understanding ISO 27018
ISO 27018 is an international standard published by the International Organization for Standardization (ISO) that provides guidance on protecting PII in the public cloud.
It outlines a code of practice for cloud service providers acting as PII processors to follow security controls and privacy principles when handling personal data on behalf of customers.
The main objectives of ISO 27018 include:
✅ Helping cloud providers comply with applicable data protection laws and regulations
✅ Enabling transparency so customers can assess providers’ data governance
✅ Assisting providers and customers in establishing contractual agreements
✅ Providing a compliance framework for multi-national cloud providers
Essentially, ISO 27018 adapts the information security controls in ISO 27002 to address PII risks in the cloud. It also specifies additional controls to cover public cloud requirements not addressed in ISO 27002.
This allows organisations to leverage ISO 27001, which sets out the requirements for an infosec management system (ISMS), while also meeting ISO 27018’s PII protections for the cloud.
Notion: ISO/IEC 27001:2022 Update KitEmpowering businesses through security compliance
Get the FREE ISO 27001:2022 Update Kit template here
🤝 Aligning with ISO 27001 and ISO 27002
ISO 27018 follows the same structure and control categories as ISO 27002 for consistency. It provides:
- Implementation guidance for ISO 27002 controls applied to PII protection in the cloud
- Additional PII controls and guidance in Annex A
By implementing the combined 27002 + 27018 control set within an ISO 27001 ISMS, organisations can take a holistic approach to securing cloud environments.
Here is how the standards work together:
🗒️ ISO 27001 – Defines ISMS requirements
🗄️ ISO 27002 – Establishes code of practice for information security controls
🔐 ISO 27018 – Extends ISO 27002 controls to address PII in the cloud
This allows organisations to leverage ISO 27001 for the overall management system, while using ISO 27002 and 27018 for specific control implementation.
Some key examples of how ISO 27018 builds on 27002 include:
- Requiring confidentiality agreements to prevent unauthorised PII use
- Limiting creation of PII in hardcopy materials
- Encrypting PII transmitted over public networks
- Establishing PII breach notification processes
- Restricting physical transfer of PII storage media
- Addressing PII privacy rights like access, correction and deletion
Together, the standards provide a robust approach to balancing privacy and security in the cloud.
🛡️ Key Controls and Safeguards
Now let’s examine some of the core control areas and safeguards within ISO 27018:
📃 Consent & Choice
- Cloud providers should enable customers to facilitate user rights like data access, rectification and erasure. This supports user privacy.
📑 Purpose Legitimacy & Specification
- Cloud providers must only process PII per customer instructions – not for their own purposes.
🔐 Collection Limitation
- Cloud providers should collect the minimum PII required to deliver services to customers. This limits exposure.
⚖️ Use, Retention & Disclosure Limitation
- Cloud providers need controls governing third-party disclosures like lawful requests for PII.
📊 Accuracy & Quality
- Cloud providers should support customers in ensuring PII accuracy and correcting flawed data.
📜 Openness, Transparency & Notice
- Cloud providers must disclose their use of subcontractors to process PII before engagement.
🔑 Individual Participation & Access
- Cloud providers should enable customers to allow user access to correct or erase their PII.
📇 Accountability
- Cloud providers must promptly notify customers about any unauthorised PII access or exposure.
🔒 Information Security
- Cloud providers need confidentiality agreements, encryption of data in transit and at rest, and controls on physical transfer of PII storage media.
📍 Privacy Compliance
- Cloud providers should document the countries where PII is stored and provide customer choice.
These requirements create a robust privacy framework tailored for public cloud environments processing personal data.
📋 Developing Compliance Programs
To leverage ISO 27018’s guidance, cloud providers and customers should take these steps:
💎 Cloud Providers:
- Understand legal/regulatory PII obligations
- Review ISO 27018’s controls for applicability
- Incorporate relevant controls into policies and processes
- Train staff on new data privacy procedures
- Disclose PII practices transparently to customers
🛡️ Cloud Customers:
- Classify personal data requiring ISO 27018 protections
- Assess provider’s ISO 27018 compliance via audit reports
- Include PII requirements in provider contracts
- Monitor provider’s PII controls over time
- Notify provider if additional safeguards are needed
By aligning security programs with ISO 27018 while leveraging ISO 27001 and 27002, companies can effectively manage risks associated with personal data in the cloud. This results in reduced compliance burdens and increased trust. 🤝
Final Thoughts
For modern businesses embracing the cloud, robust information security has never been more crucial. ISO 27018 equips organisations with practical guidance tailored for protecting PII in public cloud environments. 👍
When combined with ISO 27001 and ISO 27002 in a defense-in-depth strategy, companies can establish cloud security programs that incorporate data privacy at their core. This allows organisations to tap into the benefits of the cloud, while safeguarding sensitive data and meeting regulatory duties. 🏆
By taking the time to understand and apply ISO 27018’s PII protections, both cloud providers and their customers can unlock the potential of the cloud securely and responsibly. This will continue to be a key priority as digital transformation accelerates in the years ahead.
The future is bright – and secure! 🔒✨