Who is it for?

The ISO 27018 standard – based on ISO 27001 (which standardises information security management systems) – is aimed at all companies and organisations (regardless of their sector, size or legal form) that provide cloud services and thus process their customers’ personal data in the cloud. These may include:

• private enterprises (ranging from sole traders to large telecommunications companies),
• public institutions (e.g. schools, healthcare facilities, municipal theatres),
• government administrative bodies (e.g. district authorities, statistical offices),
• non-profit organisations (foundations, associations, trade unions).

The requirements of ISO 27018 may also apply to cloud service providers and institutions responsible for supervising personal data protection. Such organisations are usually subject to additional regulations.

Only an entity that has obtained confirmation of the compliance of its information security management system with ISO 27001 may apply for ISO 27018 certification. It is also possible to implement both standards simultaneously.

Information about the standard

The ISO 27018 standard (actually ISO/IEC 27018, as it is also a standard of the International Electrotechnical Commission) is an international standard designed to protect personal data in cloud computing. The creation of guidelines in this area became necessary due to the growing demand from various organisations to use new technologies, whilst seeking to reduce expenditure on servers or licensed security solutions. Processing and storing information in the cloud is significantly less expensive. It also allows for greater operational flexibility thanks to mobile access to the company’s digital resources. At the same time, however, it increases the risk of unauthorised access to customer data.

The aim of implementing the ISO 27018 standard is to enable the efficient elimination of risks associated with operating in a public cloud computing environment. Adherence to such a standard is nowadays essential, without which it is difficult to build customer trust. Customers must, among other things, be assured that:

• their data will not be used for any purposes other than those for which they have given their consent,
• they will have access to their own data at any time and the ability to correct or delete it,
• their data will be disclosed to third parties (e.g. service subcontractors) only to the extent necessary,
• they will be informed whenever unauthorised entities attempt to access (or do access) their data.

These objectives can be achieved precisely through the implementation of the standards set out in ISO 27018.

Benefits of implementation

Introducing the standards set out in ISO 27018 into your business primarily offers the opportunity to verify the security of data stored in the cloud and minimise the risks associated with its storage. Obtaining ISO 27018 certification also brings other benefits:

• it increases the level of trust among potential and existing customers, and thus their interest in the services provided,
• it provides a competitive advantage, as it allows the organisation to stand out from those that have not chosen to implement the ISO 27018 standard,
• it enhances the company’s credibility on the international stage and creates opportunities to establish cooperation with entities required to comply with the ISO 27018 standard.