What It Is

ISO/IEC 27018:2025 is a code of practice extending ISO 27001 and ISO 27002 specifically for protecting personally identifiable information (PII) in public clouds where providers act as PII processors. It focuses on cloud-specific privacy risks like multi-tenancy and cross-border flows, employing a risk-based approach with ~25-30 additional controls.

Key Components

• Privacy controls in organizational, people, physical, and technological themes of ISO 27001 Annex A
• Principles: consent/choice, purpose limitation, data minimization, transparency, accountability
• Integrated into ISO 27001 ISMS; assessed during its audits, no standalone certification
• Guidance on subprocessors, breach notification, data subject rights support

Why Organizations Use It

• Builds trust and accelerates procurement for CSPs
• Aligns with GDPR Article 28, HIPAA; aids legal compliance
• Reduces security questionnaire friction, favors cyber insurance
• Differentiates in market, signals privacy stewardship

Implementation Overview

• Gap analysis on existing ISMS, update Statement of Applicability
• Enhance policies, contracts, technical safeguards like encryption/logging
• Suits CSPs all sizes; low incremental cost if ISO 27001-certified
• Third-party audits via annual surveillance, 3-year recertification

What It Is

ISO 22301:2019 is the international standard specifying requirements for a Business Continuity Management System (BCMS). It provides a framework to protect against, reduce likelihood of, respond to, and recover from disruptions. Adopting a risk-based, PDCA (Plan-Do-Check-Act) approach, it ensures resilience for critical products and services.

Key Components

• 10 clauses aligned with Annex SL high-level structure.
• Core elements: context understanding, leadership commitment, BIA and risk assessment, operational controls, performance evaluation, continual improvement.
• No prescriptive controls; flexible for organizational context.
• Certification via accredited bodies, valid 3 years with annual surveillance.

Why Organizations Use It

Enhances resilience, minimizes downtime and financial losses, ensures regulatory compliance (e.g., NIS Directive), builds stakeholder trust, provides competitive edges like procurement advantages and reduced insurance premiums.

Implementation Overview

Phased approach: gap analysis, BIA, policy development, training, testing, audits. Applicable to all sizes/sectors globally. Certification involves two-stage audits (6-8 weeks), supported by tools for efficiency.