📍Join Office Hours with CyberCX — Bring your toughest GRC challenge and see it solved live
MarketplaceCybersecurityISO/IEC 27018:2025
CybersecurityStandard

ISO/IEC 27018:2025

ISO/IEC 27018:2025 Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors

ISO/IEC 27018:2025 is the global standard for managing personally identifiable information (PII) in public cloud services. It provides cloud providers with a framework to ensure privacy, security, and compliance when processing customer data.

Book your strategy callView source ↗

Overview

ISO/IEC 27018:2025 extends the ISO/IEC 27002 controls to address the unique risks of cloud computing, focusing on protecting PII handled by cloud service providers acting as data processors. Its purpose is to establish clear guidelines for transparency, accountability, and privacy-by-design, ensuring organizations meet regulatory obligations and customer expectations. The standard helps providers document control objectives, justify exclusions, and demonstrate compliance with international privacy principles.

This standard is relevant to public cloud providers, enterprises, and government agencies that rely on cloud infrastructure to process sensitive personal data. It applies across industries such as healthcare, finance, and critical infrastructure, where secure handling of PII is essential. The 2025 edition aligns with ISO/IEC 27002:2022 and introduces updated implementation guidance, including a new annex for extended best practices. By adopting ISO/IEC 27018:2025, organizations can strengthen trust, reduce risk exposure, and enhance resilience in cloud-based data processing.

Related in Cybersecurity

CybersecurityControl setGuideline

ITSG-33 — IT Security Risk Management: A Lifecycle Approach (ITSG-33)

ITSG-33 is a guideline developed by the Canadian Centre for Cyber Security to help government departments manage IT security risks effectively. It outlines activities at both departmental and project levels, providing a structured process for integrating security considerations into IT environments and maintaining authorization to operate.

Canadian Centre for Cyber Security • Canada

View details
CybersecurityStandard

ESMA Minimum Standard IT Security Controls

The ESMA Minimum Standard IT Security Controls is a cybersecurity and compliance framework that defines the minimum security requirements service providers must implement to protect ESMA systems, applications, data, and information services.

European Securities and Markets Authority (ESMA) • EU

View details
CybersecurityStandardFramework

DISP 2020 — Defence Industry Security Program (DISP)– Suitability Assessment (2020)

The Defence Industry Security Program (DISP) is an Australian Defence membership program that helps organizations implement and demonstrate appropriate security controls for participating in Defence projects and managing Defence-related information and assets.

Australian Department of Defence • Australia • v2020

View details
CybersecurityStandardFramework

DISP 2022 — Defence Industry Security Program – Suitability Requirements (2022)

The Defence Industry Security Program (DISP) is an Australian Defence security assurance program that helps organizations meet security requirements for Defence contracts and projects by implementing appropriate governance, personnel, physical, and information security controls.

Australian Government • Australia • v2022

View details

Ready to manage these frameworks?

6clicks maps regulations to controls, evidence and risks — automatically.

Book your strategy call