MarketplaceCybersecurityISO/IEC 27018:2025

CybersecurityStandard

ISO/IEC 27018:2025

ISO/IEC 27018:2025 Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors

ISO/IEC 27018:2025 is the global standard for managing personally identifiable information (PII) in public cloud services. It provides cloud providers with a framework to ensure privacy, security, and compliance when processing customer data.

Book your strategy call View source ↗

Overview

ISO/IEC 27018:2025 extends the ISO/IEC 27002 controls to address the unique risks of cloud computing, focusing on protecting PII handled by cloud service providers acting as data processors. Its purpose is to establish clear guidelines for transparency, accountability, and privacy-by-design, ensuring organizations meet regulatory obligations and customer expectations. The standard helps providers document control objectives, justify exclusions, and demonstrate compliance with international privacy principles.

This standard is relevant to public cloud providers, enterprises, and government agencies that rely on cloud infrastructure to process sensitive personal data. It applies across industries such as healthcare, finance, and critical infrastructure, where secure handling of PII is essential. The 2025 edition aligns with ISO/IEC 27002:2022 and introduces updated implementation guidance, including a new annex for extended best practices. By adopting ISO/IEC 27018:2025, organizations can strengthen trust, reduce risk exposure, and enhance resilience in cloud-based data processing.

Related in Cybersecurity

CybersecurityFramework

PSPF 2026 — Protective Security Policy Framework Release 2026

Protective Security Policy Framework (PSPF) Release 2026 is the Australian Government's updated protective security framework that sets mandatory requirements across six security domains to help government entities protect their people, information, assets, and resources through effective risk management and security practices.

Australian Government • Australia • v2026

CybersecurityStandard

SACSF V2.0 — South Australian Cyber Security Framework V2.0

The South Australian Cyber Security Framework (SACSF) is a cybersecurity governance framework developed by Security SA to help South Australian Government agencies manage cyber risks and protect information, systems, and digital services. It consists of 18 policy statements across four core principles—Governance, Information Security, Personnel Security, and Physical Security—and uses a four-tier risk-based approach to implement security controls proportionate to agency risk exposure.

Australian Government • South Australia • v2.0

CybersecurityStandardFramework

CAIQ v4.1.0 — Consensus Assessment Initiative Questionnaire v4.1.0

The Consensus Assessments Initiative Questionnaire (CAIQ) v4.1.0 is a comprehensive cloud security assessment questionnaire developed by the Cloud Security Alliance (CSA) and aligned with the Cloud Controls Matrix (CCM) v4.1 to help organizations evaluate the security, privacy, and compliance practices of cloud service providers. It includes 261 assessment questions mapped to 207 controls across 17 security domains, supporting detailed vendor due diligence, third-party risk management, and cloud security assessments using a standardized industry framework.

Cloud Security Alliance (CSA) • v4.1.0

CybersecurityStandard

CAIQ Lite v4.1.0 — Consensus Assessments Initiative Questionnaire Lite v4.1.0

Consensus Assessments Initiative Questionnaire (CAIQ) Lite v4.1.0 is a streamlined cloud security assessment questionnaire developed by the Cloud Security Alliance (CSA) and aligned with the Cloud Controls Matrix (CCM) v4.1 to help organizations evaluate cloud service providers using a standardized approach. It includes 138 focused questions across 17 security domains, enabling efficient vendor due diligence, third-party risk management, and security posture assessments.

Cloud Security Alliance (CSA) • v4.1.0

Ready to manage these frameworks?

6clicks maps regulations to controls, evidence and risks — automatically.

Book your strategy call