- Features and Benefits
- Applicability
- Consulting Methodology
The primary features of ISO 27018:2019 can be resolved into the below-mentioned points:
With a rise in privacy data breaches and new regulations like the GDPR, any business which stores its customers’ private details on its cloud will seek assurances that you take private data protection seriously. Introduced in 2014, ISO/IEC 27108 gives a framework for assessing how well they protect personally identifiable information (PII) in public clouds.
ISO/IEC 27018 guidelines help to protect the highly sensitive or critical PII of your organization and your customers. It also includes provisions for confidentiality agreements with CSP/CSC staff for PII processing and training. While ISO/IEC 27018 is not mandatory, it is increasingly recognised as the industry standard.
If you store any kind of PII in the cloud environment, ISO/IEC 27018 compliance audits can be invaluable. An assessment helps you to identify any vulnerabilities in your architecture and resolve them quickly.
Becoming certified provides several key benefits:
- Follow best practices – ISO/IEC 27018 audits help you to follow best practices around protection PII in the cloud, so you can be confident that your environments are safe
- Mitigate risk and reputational damage – Safeguard the access, storage, transmission and processing of PII data in the cloud by following ISO/IEC 27018 guidelines and avoid damaging data breaches
- Gain a competitive edge – As more organisations attain ISO/IEC 27018 certification, those which do not may struggle to win new contracts
- Clearly define responsibilities – ISO/IEC 27018 helps to define which areas of PII you are responsible for, and which your customers must take care of. This improves clarity and avoids misunderstandings.
- Win customer trust – A third-party certification by TÜV SÜD demonstrates your commitment to information security. Many new cloud customers will now demand evidence that you can protect PII in the cloud and may require you to fill out extensive checklists to prove it – showing you have ISO/IEC 27018 certification could save you time and effort in providing this information.
The cloud offers organizations and consumers a variety of benefits: cost savings, flexibility and mobile access to information top the list. It also raises concerns about data protection and privacy; particularly around personally identifiable information (PII). PII includes any piece of information that can identify a specific user. The more obvious examples include names and contact details or your mother’s maiden name. But ones people may not readily think of are medical records, IP addresses and banking statements.
Used with ISO/IEC 27001, ISO/IEC 27018 has been published to allow Cloud Service Providers whose infrastructure is certified to the standard to tell their existing and potential customers that their data is safeguarded and won’t be used for any purposes for which they don’t specifically give consent.