ISO/IEC 27018 establishes commonly accepted control objectives, controls, and guidelines for implementing measures to protect Personally Identifiable Information (PII) in accordance with the privacy principles in ISO/IEC 29100 for the public cloud computing environment.
In particular, ISO/IEC 27018 specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for the protection of PII which might be applicable within the context of the information security risk environment(s) of a provider of public cloud services.
ISO/IEC 27018 on personally identifiable information (PII) is useful for the organization:
ISO/IEC 27018 is also useful to:
Cloud service providers who process Personally Identifiable Information (PII) under contract to their customers have to operate their services in ways that allow both parties to meet the requirements of applicable legislation and regulations covering the protection of PII. The adoption of cloud ISO/IEC 27018 was introduced to provide an auditable standard for cloud service providers, by enabling customers to meet their own regulatory obligations on data security.
ISO/IEC 27018 establishes commonly accepted control objectives, controls, and guidelines for implementing measures to protect PII in accordance with the privacy principles in ISO/IEC 29100 for the public cloud computing environment. ISO/IEC 27018 specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for the protection of PII which may be applicable within the context of the information security risk environment(s) of a provider of public cloud services. It is an essential step towards ensuring compliance with the principles in the new Data Protection Act and boosting customer confidence in cloud computing technologies. Computing in all sectors of the economy is being promoted in order to boost productivity; however, concerns over privacy and security have acted as a barrier to migrating data to the cloud.
ISO/IEC 27018:2014