ISO 27018:2025

Requirements and controls

• 5 Organization-level controls

  • 5.1 Security policies and topic-specific policies

    Security policies include commitments to protect the PII the cloud provider processes on behalf of its customers.

    • Security Governance Program
    • Information Security & Privacy Policies
    • Management Review of Policies
    • Periodic Policy Acknowledgement
    • Data Protection Policy & Procedure

  • 5.2 Security roles and duties

    Responsibility for protecting customer PII is assigned, including a contact point for customers' privacy questions.

    • Assigned Security & Privacy Responsibilities
    • Roles & Responsibilities
    • Cybersecurity Responsibilities
    • Compliance Program Manager
    • People Operations Owner
    • Privacy Officer

  • 5.3 Separating conflicting duties

    Duties are divided so that no single person can misuse customer PII without detection.

    • Segregation of Duties
    • Organizational Structure
    • Roles & Responsibilities

  • 5.4 Management's security responsibilities

    Managers require staff who handle customer PII to apply the organization's privacy and security rules.

    • Security & Privacy Program Review
    • Periodic Policy Acknowledgement
    • New Hire Security & Privacy Training
    • Periodic Security & Privacy Training

  • 5.5 Liaison with authorities

    The provider knows which authorities may make demands about customer PII and keeps a way to contact them.

    • Cybersecurity Responsibilities

  • 5.6 Liaison with specialist security groups

    The provider follows privacy and security groups to stay current on threats to PII in cloud services.

    • Cybersecurity Responsibilities

  • 5.7 Threat intelligence gathering

    Threat information relevant to PII held in the cloud service is collected and acted on.

    • Anomalous Behavior Detection
    • Centralized Security Logging
    • Vulnerability Remediation Process
    • Incident Management Policy & Procedure

  • 5.8 Security in projects

    Projects that change the cloud service consider the protection of customer PII from the start.

    • Risk Assessment
    • Change Management Policy & Procedure
    • Approval of Changes
    • Privacy by Design Policy

  • 5.9 Asset and information inventory

    The provider knows where customer PII is stored and which systems process it.

    • Inventory of Infrastructure Assets
    • Inventory of Endpoint Assets
    • Asset Inventory Updates
    • Asset Ownership Assignment
    • Personal Data Inventory

  • 5.10 Rules for acceptable use of assets

    Staff use customer PII and the systems holding it only in ways that policy and contract allow.

    • Rules of Behavior
    • Endpoint Security Policy

  • 5.11 Returning assets

    Assets holding customer PII are returned or accounted for when staff leave or contracts end.

    • Human Resources Policy & Procedure
    • Inventory of Endpoint Assets

  • 5.12 Information classification

    Customer PII is classified so that it receives the protection it needs.

    • Data Classification Policy
    • Data Classification Labels

  • 5.13 Information labels

    Data and systems holding customer PII are labelled according to their classification.

    • Data Classification Labels
    • Data Classification Policy

  • 5.14 Transferring information

    Rules govern transfers of customer PII, and the PII is protected while in transit.

    • Transmission Confidentiality
    • Network Security Policy & Procedure
    • Third-Party Criticality Assessments

  • 5.15 Access control rules

    Access to customer PII is governed by documented access rules.

    • Access Control Policy & Procedure
    • Identity Validation
    • Production Database Access Restriction

  • 5.16 Managing identities

    Identities able to reach customer PII are managed across their whole life cycle.

    • Identity Validation
    • User Access Reviews
    • Termination of Employment

  • 5.17 Managing authentication secrets

    Credentials for systems holding customer PII are issued and protected securely.

    • Password Management Guidelines
    • Multi-Factor Authentication
    • Access Control Policy & Procedure

  • 5.18 Granting and reviewing access rights

    Access to customer PII is granted on need and reviewed regularly.

    • Access Control Policy & Procedure
    • Identity Validation
    • User Privilege Reviews
    • User Access Reviews
    • Production System Access Review
    • Termination of Employment

  • 5.19 Supplier security

    Suppliers whose services could affect customer PII are assessed and managed.

    • Vendor Management Policy & Procedure
    • Third-Party Criticality Assessments
    • Management Review of Third-Party Risks

  • 5.20 Security terms in supplier agreements

    Supplier agreements contain the security and privacy terms needed to protect customer PII.

    • Vendor Management Policy & Procedure
    • Third-Party Criticality Assessments
    • Subservice Organization Evaluation
    • Contractual Obligations Register
    • Processor Data Protection Agreements

  • 5.21 ICT supply chain security

    PII protection requirements are passed down the ICT supply chain.

    • Vendor Management Policy & Procedure
    • Third-Party Criticality Assessments
    • Subservice Organization Evaluation
    • Management Review of Third-Party Risks

  • 5.22 Supplier service monitoring and change

    Supplier services that touch customer PII are monitored and their changes reviewed.

    • Management Review of Third-Party Risks
    • Third-Party Criticality Assessments
    • Subservice Organization Evaluation

  • 5.23 Security of cloud service use

    Cloud services the provider itself relies on are managed so that customer PII stays protected.

    • Vendor Management Policy & Procedure
    • Shared Responsibility Model
    • Subservice Organization Evaluation
    • Third-Party Criticality Assessments

  • 5.24 Incident response planning

    Incident procedures cover breaches of customer PII, including how affected customers will be told.

    • Incident Management Policy & Procedure
    • Incident Tracking
    • Automated Incident Reporting
    • Incident Reporting Assistance
    • Data Breach Notification Policy

  • 5.25 Triage of security events

    Security events are assessed to decide whether customer PII may be affected.

    • Incident Management Policy & Procedure
    • Incident Tracking

  • 5.26 Responding to incidents

    Incidents involving customer PII are contained and handled under documented procedures.

    • Incident Management Policy & Procedure
    • Incident Tracking
    • Breach Risk Assessment & Notification

  • 5.27 Lessons from incidents

    Lessons from incidents affecting PII are used to strengthen protection.

    • Incident Management Policy & Procedure
    • Incident Tracking
    • Security & Privacy Program Review

  • 5.28 Evidence collection

    Evidence about incidents involving PII is collected and preserved.

    • Incident Management Policy & Procedure
    • Centralized Security Logging

  • 5.29 Security during disruption

    Protection of customer PII is maintained during disruptions.

    • Business Continuity Policy & Procedure
    • Disaster Recovery Policy
    • Disaster Recovery Testing

  • 5.30 ICT readiness for continuity

    Continuity arrangements keep the cloud service, and the customer PII in it, available after a disruption.

    • Disaster Recovery Policy
    • Business Continuity Policy & Procedure
    • Disaster Recovery Testing
    • Backup Restoration Testing

  • 5.31 Legal, regulatory and contractual obligations

    Data protection laws and contract terms that apply to processing customer PII are identified and met.

    • Data Governance
    • Statutory, Regulatory & Contractual Compliance
    • Contractual Obligations Register
    • Data Protection Policy & Procedure

  • 5.32 Intellectual property

    Intellectual property rights are respected in the operation of the cloud service.

    • Statutory, Regulatory & Contractual Compliance

  • 5.33 Protecting records

    Records about the processing of PII are protected from loss, alteration and unauthorized access.

    • Policy Documentation Retention
    • Data Retention Policy
    • Statutory, Regulatory & Contractual Compliance

  • 5.34 Privacy and PII obligations

    The provider meets the privacy and PII protection requirements that apply to it as a processor.

    • Data Protection Policy & Procedure
    • Privacy Officer
    • Privacy by Design Policy
    • Personal Data Inventory
    • Processor Data Protection Agreements

  • 5.35 Independent security review

    The provider's PII protection controls are reviewed independently, and the results are shared with customers where agreed.

    • Internal Audit
    • Security & Privacy Program Review
    • Penetration Testing

  • 5.36 Conformance with security policies

    Compliance with the policies for handling customer PII is checked regularly.

    • Internal Audit
    • Management Review of Policies
    • Statutory, Regulatory & Contractual Compliance

  • 5.37 Written operating procedures

    Procedures for operating the systems that process customer PII are documented.

    • Information Security & Privacy Policies
    • ISMS Manual
    • Change Management Policy & Procedure
    • Data Backup Policy

• 6 Controls for people

  • 6.1 Background screening

    People with access to customer PII are screened before they start.

    • Personnel Screening
    • Competency Screening

  • 6.2 Employment terms

    Employment terms include the obligation to protect customer PII.

    • Code of Business Conduct
    • New Hire Policy Acknowledgement
    • Human Resources Policy & Procedure
    • Roles & Responsibilities

  • 6.3 Security awareness and training

    Staff are trained on handling customer PII and on the consequences of breaking privacy rules.

    • Security & Privacy Awareness
    • New Hire Security & Privacy Training
    • Periodic Security & Privacy Training

  • 6.4 Disciplinary action for breaches

    Breaches of PII handling rules lead to disciplinary action.

    • Code of Business Conduct
    • Human Resources Policy & Procedure

  • 6.5 Duties after leaving or changing role

    Obligations to protect customer PII continue after staff leave or change role.

    • Human Resources Policy & Procedure
    • Termination of Employment

  • 6.6 Confidentiality agreements

    Staff and contractors who can access customer PII are bound by confidentiality agreements.

    • New Hire Policy Acknowledgement
    • Periodic Policy Acknowledgement
    • Contractual Obligations Register

  • 6.7 Remote work security

    Remote work involving customer PII uses secured devices and connections.

    • Endpoint Security Policy
    • Endpoint Encryption
    • Multi-Factor Authentication
    • Session Lock
    • Malware Protection

  • 6.8 Reporting security events

    Staff report events that may affect customer PII without delay.

    • Automated Incident Reporting
    • Incident Reporting Assistance
    • Incident Management Policy & Procedure

• 7 Controls for premises and equipment

  • 7.1 Physical perimeters

    Facilities processing customer PII have secure perimeters.

    • Physical Protection Policy & Procedure

  • 7.2 Controlled physical entry

    Entry to areas where customer PII is processed is restricted.

    • Physical Protection Policy & Procedure

  • 7.3 Securing offices and facilities

    Offices and rooms where customer PII is handled are secured.

    • Physical Protection Policy & Procedure

  • 7.4 Monitoring of premises

    Premises processing customer PII are watched for unauthorized access.

    • Physical Protection Policy & Procedure
    • Subservice Organization Evaluation

  • 7.5 Physical and environmental threats

    Facilities holding customer PII are protected against physical and environmental threats.

    • Physical Protection Policy & Procedure
    • Business Continuity Policy & Procedure
    • Disaster Recovery Policy

  • 7.6 Work in secure areas

    Rules govern work in secure areas where customer PII is processed.

    • Physical Protection Policy & Procedure

  • 7.7 Clearing desks and screens

    Customer PII is not left exposed on desks or unattended screens.

    • Clear Desk & Clear Screen
    • Session Lock

  • 7.8 Equipment placement and protection

    Equipment processing customer PII is placed to reduce physical risk.

    • Physical Protection Policy & Procedure
    • Endpoint Security Policy

  • 7.9 Assets used off-site

    Devices taken off-site that hold customer PII are protected.

    • Endpoint Security Policy
    • Endpoint Encryption
    • Inventory of Endpoint Assets
    • Malware Protection

  • 7.10 Storage media handling

    Storage media containing customer PII are controlled throughout their life cycle.

    • Media Disposal Policy
    • Endpoint Encryption
    • Data Classification Policy

  • 7.11 Utility services

    Utilities supporting systems with customer PII are protected against failure.

    • Physical Protection Policy & Procedure
    • Subservice Organization Evaluation

  • 7.12 Cabling protection

    Cabling for systems that process customer PII is protected.

    • Physical Protection Policy & Procedure
    • Subservice Organization Evaluation

  • 7.13 Maintaining equipment

    Equipment processing customer PII is maintained securely.

    • Endpoint Security Validation
    • Endpoint Security Policy

  • 7.14 Disposal and reuse of equipment

    Storage that held customer PII is sanitized or destroyed before disposal or reuse.

    • Media Disposal Policy

• 8 Technology controls

  • 8.1 Endpoint devices

    Endpoint devices that can reach customer PII are secured.

    • Endpoint Security Policy
    • Malware Protection
    • Endpoint Security Validation
    • Endpoint Encryption
    • Session Lock

  • 8.2 Privileged access

    Privileged access to systems holding customer PII is restricted and monitored.

    • Production Database Access Restriction
    • User Privilege Reviews
    • Multi-Factor Authentication
    • Access Control Policy & Procedure

  • 8.3 Restricting access to information

    Access to customer PII is limited to authorized users and purposes.

    • Access Control Policy & Procedure
    • Identity Validation
    • Production Database Access Restriction
    • User Access Reviews

  • 8.4 Source code access

    Access to the cloud service's source code is controlled.

    • Identity Validation
    • User Privilege Reviews
    • Secure System Modification
    • Approval of Changes

  • 8.5 Authentication mechanisms

    Systems holding customer PII are accessed through secure authentication.

    • Multi-Factor Authentication
    • Password Management Guidelines
    • Cloud Console Session Timeout

  • 8.6 Capacity planning

    Capacity is managed so that customer PII remains available.

    • Capacity & Performance Management
    • Impact Analysis

  • 8.7 Malware protection

    Systems processing customer PII are protected against malware.

    • Malware Protection

  • 8.8 Technical vulnerability management

    Vulnerabilities in systems processing customer PII are fixed promptly.

    • Vulnerability Remediation Process
    • Centralized Flaw Remediation
    • Penetration Testing
    • Vulnerability Management Policy & Procedure

  • 8.9 Secure configuration

    Systems processing customer PII are configured securely.

    • External System Connections
    • Endpoint Security Validation
    • Endpoint Security Policy
    • Impact Analysis

  • 8.10 Deleting information

    Customer PII is deleted once it is no longer required.

    • Data Retention Policy
    • Media Disposal Policy

  • 8.11 Masking data

    Customer PII is masked or pseudonymized where appropriate.

    • Test Data Protection
    • Data Classification Policy
    • Encryption Policy & Procedure

  • 8.12 Preventing data leakage

    Leakage of customer PII is prevented and detected.

    • Data Classification Policy
    • Transmission Confidentiality
    • Endpoint Encryption
    • Encryption of Data at Rest

  • 8.13 Backups

    Backups of customer PII are taken, protected and kept according to policy.

    • Data Backup Policy
    • Data Backups
    • Backup Restoration Testing

  • 8.14 Redundant processing facilities

    Redundancy keeps the services that process customer PII available.

    • Data Backups
    • Business Continuity Policy & Procedure
    • Disaster Recovery Policy

  • 8.15 Logging activity

    Access to and processing of customer PII are logged, and the logs are protected.

    • Centralized Security Logging
    • Anomalous Behavior Detection

  • 8.16 Monitoring for anomalies

    Systems holding customer PII are monitored for unusual activity.

    • Anomalous Behavior Detection
    • Centralized Security Logging
    • Capacity & Performance Management
    • Unauthorized Activity Monitoring

  • 8.17 Time synchronization

    System clocks are synchronized so that events involving PII can be traced.

    • Clock Synchronization

  • 8.18 Powerful utility programs

    Utility programs that could bypass PII protections are restricted.

    • User Privilege Reviews
    • Production Database Access Restriction

  • 8.19 Software installation on production systems

    Software installation on systems holding customer PII is controlled.

    • Approval of Changes
    • Endpoint Security Policy
    • Rules of Behavior

  • 8.20 Network protection

    Networks carrying customer PII are secured.

    • External System Connections
    • Limit Network Connections
    • Network Security Policy & Procedure
    • Transmission Confidentiality

  • 8.21 Network service security

    Network services used for customer PII are secured and monitored.

    • External System Connections
    • Network Security Policy & Procedure
    • Network & Data Flow Diagrams
    • Subservice Organization Evaluation

  • 8.22 Network segmentation

    Networks are segregated to isolate systems holding customer PII.

    • Limit Network Connections
    • External System Connections
    • Network Security Policy & Procedure
    • Network & Data Flow Diagrams

  • 8.23 Filtering web access

    Web access is filtered to reduce threats to customer PII.

    • Malware Protection
    • Endpoint Security Policy

  • 8.24 Cryptography

    Customer PII is encrypted where appropriate, with keys managed securely.

    • Encryption Policy & Procedure
    • Encryption of Data at Rest
    • Transmission Confidentiality
    • Endpoint Encryption

  • 8.25 Secure development process

    The cloud service is developed under a secure development process that considers privacy.

    • Change Management Policy & Procedure
    • Secure System Modification
    • Approval of Changes
    • Privacy by Design Policy

  • 8.26 Security requirements for applications

    Privacy and security requirements are defined for applications that process PII.

    • Change Management Policy & Procedure
    • Input Range Validation
    • Mandatory Field Validation
    • Vulnerability Remediation Process

  • 8.27 Secure architecture and engineering

    Systems are engineered with privacy and security principles built in.

    • Change Management Policy & Procedure
    • Network & Data Flow Diagrams
    • Privacy by Design Policy

  • 8.28 Secure coding practices

    Code that processes PII follows secure coding practices.

    • Change Management Policy & Procedure
    • Approval of Changes
    • Input Range Validation
    • Vulnerability Remediation Process

  • 8.29 Security testing before release

    Security testing confirms that PII protections work before release.

    • Approval of Changes
    • Regression Testing
    • Penetration Testing

  • 8.30 Supervising outsourced development

    Outsourced development that involves PII is supervised.

    • Vendor Management Policy & Procedure
    • Third-Party Criticality Assessments
    • Change Management Policy & Procedure
    • Approval of Changes

  • 8.31 Separate development, test and production

    Production PII stays out of development and test environments unless it is protected to production standards.

    • Test Data Protection
    • Secure System Modification

  • 8.32 Change control

    Changes to systems processing customer PII are controlled.

    • Change Management Policy & Procedure
    • Secure System Modification
    • Approval of Changes
    • Deployment Notifications

  • 8.33 Test data

    Test data is chosen and protected so that customer PII is not exposed.

    • Test Data Protection

  • 8.34 Protecting systems during audits

    Audit testing is planned so that it does not expose customer PII.

    • Internal Audit
    • Penetration Testing

• Annex A Extended controls for public cloud PII processors

  • A.2 Individual choice and consent

    • A.2.1 Helping customers honor individuals' rights

      The provider gives customers the means to respond when individuals ask to access, correct or erase their PII.

      • Data Subject Requests
      • Privacy Officer
      • Contractual Obligations Register

  • A.3 Legitimate, specified purposes

    • A.3.1 Processing only on customer instructions

      Customer PII is processed only for the purposes the customer has set out in the contract.

      • Data Protection Policy & Procedure
      • Processor Data Protection Agreements
      • Contractual Obligations Register
      • Personal Data Inventory

    • A.3.2 No marketing use of customer PII

      Customer PII is not used for marketing or advertising without the individual's express consent, and that consent is never a condition of using the service.

      • Data Protection Policy & Procedure
      • Consent Management
      • Contractual Obligations Register

  • A.5 Minimizing data

    • A.5.1 Erasing temporary files

      Temporary files and documents created while processing PII are erased within a defined period.

      • Data Retention Policy
      • Media Disposal Policy

  • A.6 Limits on use, retention and disclosure

    • A.6.1 Notifying customers of disclosure demands

      The provider tells the customer about legally binding demands to disclose its PII, unless the law forbids it.

      • Data Protection Policy & Procedure
      • Contractual Obligations Register
      • Privacy Officer

    • A.6.2 Recording PII disclosures

      Every disclosure of customer PII to a third party is recorded, including what was disclosed, to whom and when.

      • Personal Data Inventory
      • Data Subject Requests
      • Privacy Officer

  • A.8 Transparency toward customers

    • A.8.1 Disclosing sub-processors

      Customers are told which sub-processors will handle their PII before processing begins.

      • Processor Data Protection Agreements
      • Third-Party Criticality Assessments
      • Publishing Security & Privacy Documentation
      • Contractual Obligations Register

  • A.10 Accountability to customers

    • A.10.1 Breach notification to customers

      The provider promptly notifies the affected customer of any unauthorized access to its PII and keeps a record of each such incident.

      • Breach Risk Assessment & Notification
      • PII Breach Notification Guidelines
      • Data Breach Notification Policy
      • Incident Management Policy & Procedure

    • A.10.2 Keeping superseded security policies

      Copies of security policies and procedures are kept for a defined period after they are replaced.

      • Policy Documentation Retention
      • Data Retention Policy

    • A.10.3 Returning, transferring and disposing of PII

      The provider has a policy for returning, transferring or securely destroying customer PII and makes it known to customers.

      • Data Retention Policy
      • Media Disposal Policy
      • Contractual Obligations Register

  • A.11 Security of PII

    • A.11.1 Confidentiality duties for staff

      Everyone who can access customer PII is bound by a confidentiality obligation.

      • New Hire Policy Acknowledgement
      • Periodic Policy Acknowledgement
      • Code of Business Conduct

    • A.11.2 Limiting printed copies

      Printing or otherwise producing hardcopies of customer PII is restricted.

      • Clear Desk & Clear Screen
      • Data Classification Policy
      • Rules of Behavior

    • A.11.3 Logging data restoration

      Restoring data from backup is authorized and recorded.

      • Backup Restoration Testing
      • Centralized Security Logging
      • Data Backups

    • A.11.4 Protecting media leaving the premises

      Storage media holding PII that leave the provider's premises are authorized, protected and tracked.

      • Endpoint Encryption
      • Media Disposal Policy
      • Endpoint Security Policy

    • A.11.5 Avoiding unencrypted portable media

      Portable storage without encryption is not used for customer PII, except where unavoidable and then documented.

      • Endpoint Encryption
      • Endpoint Security Policy
      • Rules of Behavior

    • A.11.6 Encrypting PII on public networks

      PII sent over public networks is encrypted.

      • Transmission Confidentiality
      • Encryption Policy & Procedure

    • A.11.7 Destroying hardcopy securely

      Paper and other hardcopy containing PII is destroyed securely, for example by cross-cut shredding.

      • Media Disposal Policy
      • Clear Desk & Clear Screen

    • A.11.8 Individual user IDs

      Each person who accesses customer PII does so under their own user ID.

      • Identity Validation
      • User Access Reviews

    • A.11.9 Managing user IDs

      User IDs are issued, disabled and removed in a controlled way, and disabled IDs are not handed to someone else.

      • Identity Validation
      • Termination of Employment
      • User Access Reviews

    • A.11.10 Register of authorized users

      An up-to-date record shows who may access systems holding customer PII and with which rights.

      • User Access Reviews
      • Production System Access Review
      • User Privilege Reviews

    • A.11.11 Security commitments in customer contracts

      Customer contracts state the minimum security measures the provider maintains for the customer's PII.

      • Processor Data Protection Agreements
      • Contractual Obligations Register
      • Vendor Management Policy & Procedure

    • A.11.12 Sub-processor obligations

      Sub-processors are bound by contract to protect customer PII to at least the provider's own standard.

      • Processor Data Protection Agreements
      • Third-Party Criticality Assessments
      • Management Review of Third-Party Risks
      • Vendor Management Policy & Procedure

    • A.11.13 Clearing reused storage

      Storage space assigned to a customer cannot reveal data left behind by a previous user.

      • Media Disposal Policy
      • Tenant Isolation
      • Encryption of Data at Rest

  • A.12 Where PII is stored and sent

    • A.12.1 Disclosing where PII is stored

      Customers are told the countries in which their PII may be stored or processed.

      • Cross-Border Data Transfers
      • Publishing Security & Privacy Documentation
      • Contractual Obligations Register

    • A.12.2 Delivery to the intended destination

      PII sent across networks is routed so that it reaches only its intended destination.

      • Transmission Confidentiality
      • External System Connections
      • Network Security Policy & Procedure