What is the primary objective of **ISO 27018**?

**ISO 27018 provides a code of practice for protecting personally identifiable information (PII) in public clouds acting as PII processors.** It extends **ISO 27001** and **ISO 27002** with ~25–30 privacy-specific controls addressing cloud risks like multi-tenancy, subprocessor transparency, consent, purpose limitation, data minimization, breach notification, and restrictions on secondary PII use (e.g., no marketing without consent). The 2025 edition aligns with **ISO 27002:2022**, emphasizing processor obligations across the PII lifecycle.

Who is legally or professionally required to comply with **ISO 27018**?

**ISO 27018 applies to public cloud service providers (CSPs) acting as PII processors for customers.** It targets hyperscalers, regional platforms, and sector-specific clouds (e.g., healthcare, finance) handling customer PII via multi-tenant environments. Controllers use it for vendor due diligence, but it excludes controller-specific duties and private clouds; compliance is risk-based, not legally mandated but expected for GDPR Article 28 alignment and procurement.

Does **ISO 27018** require an external audit or third-party certification?

**ISO 27018 does not offer standalone certification; it is assessed via external ISO 27001 audits by accredited bodies under ISO/IEC 17021 and 27006.** Controls integrate into the **ISMS** **Statement of Applicability**; auditors validate ~25–30 additional privacy controls during Stage 1 (documents) and Stage 2 (implementation) audits, with certificates referencing both standards.

How often should an assessment for **ISO 27018** be performed?

**ISO 27018 assessments occur via annual surveillance audits and full recertification every three years as part of ISO 27001 certification cycles.** Ongoing internal reviews, gap analyses, and continual improvement plans address changes in cloud services, subprocessors, or regulations; Microsoft exemplifies annual third-party audits for aligned controls.

What are the consequences of non-compliance with **ISO 27018**?

**Non-compliance with ISO 27018 risks lost procurement opportunities, regulatory scrutiny under laws like GDPR, and cyber insurance challenges, as it signals weak PII processor controls.** No direct fines exist (voluntary code), but failure undermines GDPR Article 28 obligations, potentially exposing CSPs to customer contract breaches, reputational damage, and barriers in regulated sectors.

An **ISO 27018** be mapped to other international frameworks?

**Yes, ISO 27018 maps directly to ISO 27001 Annex A (93 controls), ISO 27002:2022 guidance, ISO 27017 (cloud security), and ISO 27701 (PIMS for controllers/processors).** Its privacy controls align with GDPR Article 28 processor duties, ISO/IEC 29100 principles (consent, transparency), and OECD guidelines, enabling unified **ISMS** integration without standalone certification.

What is the first step to begin implementing **ISO 27018**?

**Conduct a gap analysis of existing ISO 27001 ISMS against ISO 27018 controls, focusing on PII lifecycle, subprocessors, and data subject rights.** Engage stakeholders for discovery, review policies/contracts/technical configs, produce a prioritized remediation roadmap, and update the **Statement of Applicability** to layer in ~25–30 privacy controls.

What is the primary objective of **SAMA CSF**?

**SAMA CSF aims to create a common cybersecurity approach across financial institutions, achieve appropriate maturity levels, and ensure proper risk management.** Version 1.0 (May 2017) prescribes principles, objectives, and controls across four domains—Cyber Security Leadership and Governance, Risk Management and Compliance, Operations and Technology, and Third Party Cyber Security—using a six-level maturity model targeting at least Level 3 (Structured and Formalized).

Who is legally or professionally required to comply with **SAMA CSF**?

**SAMA CSF is mandatory for all SAMA-regulated entities, including banks, insurance/reinsurance companies, financing companies, credit bureaus, and financial market infrastructures operating in Saudi Arabia.** All domains apply fully to banks; non-banks have tailored exceptions (e.g., excluding payment systems unless handling cardholder data or SWIFT). Boards, senior management, CISOs, and compliance officers bear accountability.

Does **SAMA CSF** require an external audit or third-party certification?

**No, SAMA CSF mandates periodic self-assessments using SAMA-provided questionnaires and internal/external audits, but does not require third-party certification.** SAMA conducts supervisory reviews; internal audits must align with the framework and auditing standards, with evidence from policies, KRIs, and maturity assessments submitted for regulatory scrutiny.

How often should an assessment for **SAMA CSF** be performed?

**SAMA CSF requires periodic self-assessments using official questionnaires, with annual reviews of critical assets and ongoing monitoring via KPIs/KRIs.** Maturity levels are evaluated continuously at Level 4+; penetration testing occurs annually for customer-facing services, alongside routine internal audits and SAMA supervisory reviews.

What are the consequences of non-compliance with **SAMA CSF**?

**Non-compliance with SAMA CSF triggers regulatory enforcement, including supervisory actions, remediation demands, heightened scrutiny, and potential operational restrictions.** As a mandated framework, violations fall under SAMA's broader banking powers, risking audit findings, business conditions, financial losses from incidents, and reputational damage without specified fines in the document.

An **SAMA CSF** be mapped to other international frameworks?

**Yes, SAMA CSF conceptually aligns with NIST CSF, ISO 27001, PCI-DSS, BASEL, and SWIFT CSCF, enabling control mappings for integrated compliance.** Its principle-based structure and maturity model support leveraging existing implementations, though sector-specific controls (e.g., e-banking MFA, payment systems) require tailored adaptations.

What is the first step to begin implementing **SAMA CSF**?

**The first step is securing Board and senior management sponsorship, followed by a control-level gap analysis and initial maturity assessment against the framework.** Phase 1 involves establishing governance (e.g., cyber security committee, CISO appointment), asset inventory, and a baseline report targeting Level 3 maturity.

ISO 27018 vs SAMA CSF

Standards Comparison

ISO 27018

Voluntary

2019

Code of practice for PII protection in public cloud processors

SAMA CSF

Mandatory

2017

Saudi regulatory framework for financial cybersecurity compliance

Quick Verdict

ISO 27018 provides voluntary cloud PII privacy controls globally for CSPs, while SAMA CSF mandates comprehensive cybersecurity maturity for Saudi financial firms. CSPs adopt 27018 for trust and procurement; Saudi banks use CSF for regulatory compliance and resilience.

Cloud Privacy

ISO 27018

ISO/IEC 27018:2025 Code of practice for PII protection in public clouds

Cost

€€€

Complexity

Medium

Implementation Time

6-12 months

Key Features

Privacy-specific controls for public cloud PII processors
Mandates subprocessor transparency and disclosure
Prohibits PII use for marketing without consent
Requires customer breach notification procedures
Integrates as extension to ISO 27001 audits

Cybersecurity

SAMA CSF

SAMA Cyber Security Framework Version 1.0

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Six-level maturity model targeting Level 3 minimum
Four core domains with detailed subdomains
Principle-based controls aligned to NIST/ISO
Mandatory board oversight and CISO role
Third-party risk management requirements

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

ISO 27018 Details

What It Is

ISO/IEC 27018:2025 is a code of practice extending ISO 27001 and ISO 27002 for protecting personally identifiable information (PII) in public clouds where providers act as PII processors. Its primary scope targets cloud-specific privacy risks like multi-tenancy and cross-border flows, using a risk-based approach integrated into an Information Security Management System (ISMS).

Key Components

Core domains: transparency, contractual obligations, data subject rights support, breach management, data minimization.
~25-30 additional privacy controls mapped to ISO 27001 Annex A (93 controls).
Built on principles: consent, purpose limitation, accountability.
Assessed via ISO 27001 audits; no standalone certification.

Why Organizations Use It

Enhances trust, accelerates procurement, aligns with GDPR Article 28, reduces risk in cloud outsourcing. Provides competitive differentiation for CSPs, favorable insurance terms, and evidence of due care.

Implementation Overview

Conduct gap analysis against existing ISMS, update Statement of Applicability, implement controls like subprocessor disclosure. Suited for CSPs of all sizes; requires annual audits post-ISO 27001 certification. Focuses on documentation, training, technical safeguards.

SAMA CSF Details

What It Is

The Saudi Arabian Monetary Authority Cyber Security Framework (SAMA CSF), Version 1.0 (May 2017), is a mandatory regulatory framework for SAMA-regulated financial institutions in Saudi Arabia. It provides a principle-based, outcome-oriented approach to cybersecurity governance, focusing on detecting, resisting, responding to, and recovering from cyber threats across information assets.

Key Components

Four principal **domainsCyber Security Leadership & Governance, Risk Management & Compliance, Operations & Technology, Third-Party Cyber Security.
Numerous subdomains with principles, objectives, and control considerations (over 100 subcontrols).
Six-level maturity model (Level 0-5), with Level 3 (structured/formalized) as regulatory baseline.
Built on NIST, ISO 27001, PCI-DSS; enforced via self-assessments and SAMA audits.

Why Organizations Use It

Mandatory compliance for banks, insurers, etc., avoiding penalties and scrutiny.
Enhances resilience, reduces incident risks, enables efficiency and partnerships.
Builds stakeholder trust, competitive edge in digital finance.

Implementation Overview

Phased roadmap: gap analysis, risk assessment, control deployment, monitoring.
Applies to all SAMA entities; scalable by size.
Requires self-assessments, evidence portfolios; no external certification.

Key Differences

Aspect	ISO 27018	SAMA CSF
Scope	PII protection in public clouds for processors	Comprehensive cybersecurity across financial operations
Industry	Cloud service providers globally, all sectors	Saudi financial institutions (banks, insurance) only
Nature	Voluntary code of practice, ISO 27001 extension	Mandatory regulatory framework for compliance
Testing	Assessed in ISO 27001 audits, annual surveillance	Periodic self-assessments, SAMA supervisory audits
Penalties	Loss of alignment/audit failure, no legal fines	Fines, license suspension, regulatory enforcement

Scope

ISO 27018

PII protection in public clouds for processors

SAMA CSF

Comprehensive cybersecurity across financial operations

Industry

ISO 27018

Cloud service providers globally, all sectors

SAMA CSF

Saudi financial institutions (banks, insurance) only

Nature

ISO 27018

Voluntary code of practice, ISO 27001 extension

SAMA CSF

Mandatory regulatory framework for compliance

Testing

ISO 27018

Assessed in ISO 27001 audits, annual surveillance

SAMA CSF

Periodic self-assessments, SAMA supervisory audits

Penalties

ISO 27018

Loss of alignment/audit failure, no legal fines

SAMA CSF

Fines, license suspension, regulatory enforcement

Frequently Asked Questions

Common questions about ISO 27018 and SAMA CSF

ISO 27018 FAQ

SAMA CSF FAQ

You Might also be Interested in These Articles...

NIST CSF 2.0 Supply Chain Risk Management: Complete Playbook with Profiles, Tiers, and Vendor Assessment Templates

Master NIST CSF 2.0 ID.SC supply chain risk management with vendor assessment templates, profile gap analysis, and tier strategies. Mitigate third-party threats

From Data Fragments to Strategic Insight: Powering Intelligent Risk Management with Integrated Compliance Monitoring

Transform data fragments into strategic insights with integrated compliance monitoring. Automate real-time risk management, ensure GDPR & SOC 2 compliance, and

CIS Controls v8.1, Operationalized: Top 10 Reasons Compliance Monitoring Software Accelerates Real-World Implementation

Operationalize CIS Controls v8.1 with compliance monitoring software. Turn checklists into dashboards, tickets, and audit-proof workflows. Top 10 reasons it acc

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Check out these other Gradum.io Standards Comparison Pages

PIPL vs CCPA

Compare PIPL vs CCPA: China's GDPR-like law vs California's consumer rights powerhouse. Unpack extraterritorial scope, fines to 5% revenue, rights & compliance strategies for global firms. Dive in now!

Australian Privacy Act vs ISO 28000

Compare Australian Privacy Act vs ISO 28000: Principles-based privacy (APPs, NDB) meets supply chain security standards. Uncover gaps, risks, reforms & strategies for compliance. Safeguard data now!

COBIT vs ISO/IEC 42001:2023

Compare COBIT vs ISO/IEC 42001:2023—IT governance meets AI management. Tailor I&T via COBIT's 40 objectives or secure AI lifecycles with PDCA & Annex A. Boost compliance now!

ISO 27018

SAMA CSF

Quick Verdict

ISO 27018

Key Features

SAMA CSF

Key Features

Detailed Analysis

ISO 27018 Details

What It Is

Key Components

Why Organizations Use It

Implementation Overview

SAMA CSF Details

What It Is

Key Components

Why Organizations Use It

Implementation Overview

Key Differences

Scope

Industry

Nature

Testing

Penalties

Frequently Asked Questions

ISO 27018 FAQ

What is the primary objective of ISO 27018?

Who is legally or professionally required to comply with ISO 27018?

Does ISO 27018 require an external audit or third-party certification?

How often should an assessment for ISO 27018 be performed?

What are the consequences of non-compliance with ISO 27018?

An ISO 27018 be mapped to other international frameworks?

What is the first step to begin implementing ISO 27018?

SAMA CSF FAQ

What is the primary objective of SAMA CSF?

Who is legally or professionally required to comply with SAMA CSF?

Does SAMA CSF require an external audit or third-party certification?

How often should an assessment for SAMA CSF be performed?

What are the consequences of non-compliance with SAMA CSF?

An SAMA CSF be mapped to other international frameworks?

What is the first step to begin implementing SAMA CSF?

You Might also be Interested in These Articles...

NIST CSF 2.0 Supply Chain Risk Management: Complete Playbook with Profiles, Tiers, and Vendor Assessment Templates

From Data Fragments to Strategic Insight: Powering Intelligent Risk Management with Integrated Compliance Monitoring

CIS Controls v8.1, Operationalized: Top 10 Reasons Compliance Monitoring Software Accelerates Real-World Implementation

Run Maturity Assessments with GRADUM

Check out these other Gradum.io Standards Comparison Pages

PIPL vs CCPA

Australian Privacy Act vs ISO 28000

COBIT vs ISO/IEC 42001:2023