What It Is

ISO/IEC 27018:2025 is an international code of practice extending ISO 27001 and ISO 27002 specifically for protecting personally identifiable information (PII) in public clouds where providers act as PII processors. Its primary scope targets cloud service providers (CSPs) handling customer PII, addressing multi-tenancy, cross-border flows, and subprocessors. It uses a risk-based approach, layering ~25-30 privacy-specific controls onto the ISMS framework.

Key Components

• Core control areas: transparency, contractual obligations, data subject rights support, breach management, secure PII lifecycle handling.
• Aligned with privacy principles like consent, purpose limitation, data minimization, accountability.
• Maps to ISO 27001 Annex A (93 controls across Organizational, People, Physical, Technological themes).
• No standalone certification; assessed within ISO 27001 audits via Statement of Applicability.

Why Organizations Use It

CSPs adopt it for procurement acceleration, customer trust, GDPR Article 28 alignment, cyber insurance benefits, and market differentiation. It mitigates privacy risks in cloud environments and demonstrates processor diligence.

Implementation Overview

Start with gap analysis on existing ISMS, update policies/contracts, implement technical safeguards. Applicable to CSPs of all sizes globally. Requires third-party audits integrated into ISO 27001 cycles (annual surveillance, 3-year recertification).

What It Is

APRA Prudential Standard CPS 234 (Information Security) is a binding regulation issued by the Australian Prudential Regulation Authority, effective 1 July 2019. It mandates information security capabilities for APRA-regulated financial entities to ensure resilience against cyber threats. The risk-based approach requires commensurate governance, controls, testing, and reporting across information assets, including those managed by third parties.

Key Components

• **11 core requirementsBoard accountability, role definitions, capability maintenance, policy framework, asset classification, lifecycle controls, incident response, systematic testing, internal audit, and APRA notifications.
• Built on CIA triad (confidentiality, integrity, availability).
• No fixed controls; focuses on assurance-driven compliance via independent testing and audits.

Why Organizations Use It

• Mandatory for ADIs, insurers, super funds to avoid penalties, enforcement.
• Enhances cyber resilience, stakeholder protection, operational continuity.
• Builds trust, reduces incident impacts, integrates with CPS 220/230.

Implementation Overview

• Phased: gap analysis, governance, asset inventory, controls, testing, monitoring.
• Applies to all sizes in Australian financial sector; third-party transition by 1 July 2020.
• Requires internal audit and annual testing; no formal certification but APRA supervision.