📖 What is ISO/IEC 27018?
ISO/IEC 27018 is an international code of practice for protecting personally identifiable information (PII) in public clouds. It provides specific guidance for cloud service providers to ensure the privacy and protection of customer data.
"This is the 'Privacy' standard. If the exam question mentions PII in a public cloud context, this is the standard you are looking for."
📚 Certification: CCSP (CCSP)
🔑 What are the Key Concepts of ISO/IEC 27018?
- ▸ Acts as an extension to ISO/IEC 27001 and 27017, specifically tailoring security controls to the protection of PII within public cloud environments.
- ▸ Strictly prohibits the use of customer PII for marketing purposes or advertising unless the cloud service customer has provided explicit, informed consent.
- ▸ Mandates that PII is processed only for the purposes specified in the contract, preventing the provider from using data for unauthorized secondary purposes.
- ▸ Requires CSPs to provide transparency regarding the geographic locations where PII is stored and processed to help customers meet regional regulatory requirements.
- ▸ Focuses on the CSP's responsibility to notify customers of PII breaches and provide verified mechanisms for the secure deletion or return of data.
🎯 How does ISO/IEC 27018 appear on the CCSP Exam?
You may be asked to identify the most appropriate international standard to implement when a cloud provider needs to demonstrate a specific commitment to protecting PII in a public cloud.
A scenario might describe a customer requiring a contractual guarantee that their PII will not be used for the provider's own marketing; identify ISO/IEC 27018 as the guiding framework.
Expect questions where you must distinguish between general cloud security controls found in ISO 27017 and specific privacy protections for PII defined in ISO 27018.
❓ Frequently Asked Questions
How does ISO 27018 differ from ISO 27017?
ISO 27017 focuses on general cloud security controls for both CSPs and customers, whereas ISO 27018 is specifically dedicated to the privacy and protection of PII in public clouds.
Is ISO 27018 a standalone certification?
No, it is a code of practice. It is designed to be used in conjunction with ISO/IEC 27001, providing specific PII-related guidance that supplements the broader management system.
Does ISO 27018 apply to private cloud deployments?
No, the standard is specifically designed for PII in public clouds, addressing the unique privacy risks associated with multi-tenancy and shared infrastructure managed by a third party.