ISO/IEC 27018:2025

Information security, cybersecurity and privacy protection — Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors

This document establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect personally identifiable information (PII) in line with the privacy principles in ISO/IEC 29100 for the public cloud computing environment. In particular, this document specifies guidelines based on ISO/IEC 27002:2022, taking into consideration the regulatory requirements for the protection of PII which can be applicable within the context of the information security risk environment(s) of a provider of public cloud services. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which provide information processing services as PII processors via cloud computing under contract to other organizations. The guidelines in this document can also be relevant to organizations acting as PII controllers.

Sécurité de l’information, cybersécurité et protection de la vie privée — Lignes directrices en matière de protection des informations personnelles identifiables (PII) dans l'informatique en nuage public agissant comme processeur de PII

Le présent document établit des objectifs de sécurité communément acceptés, des mesures de sécurité et des lignes directrices de mise en œuvre de mesures destinées à protéger les informations personnelles identifiables (PII) conformément aux principes de protection de la vie privée de l'ISO/IEC 29100 pour l'environnement informatique en nuage public. En particulier, le présent document spécifie des lignes directrices dérivées de l'ISO/IEC 27002, en tenant compte des exigences réglementaires relatives à la protection des PII, qui peuvent être applicables dans le contexte du ou des environnements de risque liés à la sécurité de l'information d'un fournisseur de services en nuage public. Le présent document s'applique aux organismes de tous types et de toutes tailles, y compris les sociétés publiques et privées, les entités gouvernementales et les organismes à but non lucratif, qui offrent des services de traitement de l'information en tant que processeurs de PII via l'informatique en nuage sous contrat auprès d'autres organismes. Les lignes directrices du présent document peuvent également s'appliquer aux organismes agissant en tant que contrôleurs de PII. Cependant, les contrôleurs de PII peuvent être soumis à d'autres lois, réglementations et obligations en matière de protection des PII qui ne s'appliquent pas aux processeurs de PII. Le présent document n'a pas pour objet de couvrir des obligations supplémentaires.

General Information

• Status: Published
• Publication Date: 25-Aug-2025
• ICS: 35.030 - IT Security
• Technical Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Drafting Committee: ISO/IEC JTC 1/SC 27/WG 5 - Identity management and privacy technologies
• Current Stage: 6060 - International Standard published
• Start Date: 26-Aug-2025
• Due Date: 27-Oct-2025
• Completion Date: 26-Aug-2025

Relations

• Revises: ISO/IEC 27018:2019 - Information technology — Security techniques — Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
• Effective Date: 28-Oct-2023

Standards Content (Sample)

International
Standard
ISO/IEC 27018
Third edition
Information security, cybersecurity
2025-08
and privacy protection —
Guidelines for protection of
personally identifiable information
(PII) in public clouds acting as PII
processors
Sécurité de l’information, cybersécurité et protection de la
vie privée — Lignes directrices en matière de protection des
informations personnelles identifiables (PII) dans l'informatique
en nuage public agissant comme processeur de PII
Reference number
© ISO/IEC 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2025 – All rights reserved
ii
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Overview . 3
4.1 Structure of this document .3
4.2 Control layout .10
5 Organizational controls .11
5.1 Policies for information security . .11
5.2 Information security roles and responsibilities .11
5.3 Segregation of duties.11
5.4 Management responsibilities .11
5.5 Contact with authorities .11
5.6 Contact with special interest groups . 12
5.7 Threat intelligence . 12
5.8 Information security in project management . 12
5.9 Inventory of information and other associated assets . 12
5.10 Acceptable use of information and other associated assets . 12
5.11 Return of assets . 12
5.12 Classification of information . 12
5.13 Labelling of information . 12
5.14 Information transfer . 12
5.15 Access control . 12
5.16 Identity management . 13
5.17 Authentication information . 13
5.18 Access rights . 13
5.19 Information security in supplier relationships . 13
5.20 Addressing information security within supplier agreements . 13
5.21 Managing information security in the ICT supply chain . 13
5.22 Monitoring, review and change management of supplier services . 13
5.23 Information security for use of cloud services . 13
5.24 Information security incident management planning and preparation . 13
5.25 Assessment and decision on information security events . 13
5.26 Response to information security incidents .14
5.27 Learning from information security incidents .14
5.28 Collection of evidence . .14
5.29 Information security during disruption .14
5.30 ICT readiness for business continuity .14
5.31 Legal, statutory, regulatory and contractual requirements .14
5.32 Intellectual property rights .14
5.33 Protection of records .14
5.34 Privacy and protection of PII .14
5.35 Independent review of information security .14
5.36 Compliance with policies, rules and standards for information security . 15
5.37 Documented operating procedures . 15
6 People controls .15
6.1 Screening . 15
6.2 Terms and conditions of employment . 15
6.3 Information security awareness, education and training . 15
6.4 Disciplinary process . 15
6.5 Responsibilities after termination or change of employment. 15
6.6 Confidentiality or non-disclosure agreements . 15

© ISO/IEC 2025 – All rights reserved
iii
6.7 Remote working . 15
6.8 Information security event reporting.16
7 Physical controls . 16
7.1 Physical security perimeters .16
7.2 Physical entry .16
7.3 Securing offices, rooms and facilities .16
7.4 Physical security monitoring . .16
7.5 Protecting against physical and environmental threats .16
7.6 Working in secure areas .16
7.7 Clear desk and clear screen .16
7.8 Equipment siting and protection .16
7.9 Security of assets off-premises .16
7.10 Storage media .16
7.11 Supporting utilities .16
7.12 Cabling security .16
7.13 Equipment maintenance .17
7.14 Secure disposal or re-use of equipment .17
8 Technologica
...

FINAL DRAFT
International
Standard
ISO/IEC FDIS
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection – Guidelines
Voting begins on:
for protection of personally
2025-05-26
identifiable information (PII)
Voting terminates on:
in public clouds acting as PII
2025-07-21
processors
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
IN ADDITION TO THEIR EVALUATION AS
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
Reference number
ISO/IEC FDIS 27018:2025(en) © ISO/IEC 2025

FINAL DRAFT
ISO/IEC FDIS 27018:2025(en)
International
Standard
ISO/IEC FDIS
ISO/IEC JTC 1/SC 27
Information security, cybersecurity
Secretariat: DIN
and privacy protection – Guidelines
Voting begins on:
for protection of personally
identifiable information (PII)
Voting terminates on:
in public clouds acting as PII
processors
RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT,
WITH THEIR COMMENTS, NOTIFICATION OF ANY
RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE
AND TO PROVIDE SUPPOR TING DOCUMENTATION.
© ISO/IEC 2025
IN ADDITION TO THEIR EVALUATION AS
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
BEING ACCEPTABLE FOR INDUSTRIAL, TECHNO­
LOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
INTERNATIONAL STANDARDS MAY ON OCCASION HAVE
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL
or ISO’s member body in the country of the requester.
TO BECOME STAN DARDS TO WHICH REFERENCE MAY BE
MADE IN NATIONAL REGULATIONS.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland Reference number
ISO/IEC FDIS 27018:2025(en) © ISO/IEC 2025

© ISO/IEC 2025 – All rights reserved
ii
ISO/IEC FDIS 27018:2025(en)
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Overview . 3
4.1 Structure of this document .3
4.2 Control layout .10
5 Organizational controls .11
5.1 Policies for information security . .11
5.2 Information security roles and responsibilities .11
5.3 Segregation of duties.11
5.4 Management responsibilities .11
5.5 Contact with authorities .11
5.6 Contact with special interest groups . 12
5.7 Threat intelligence . 12
5.8 Information security in project management . 12
5.9 Inventory of information and other associated assets . 12
5.10 Acceptable use of information and other associated assets . 12
5.11 Return of assets . 12
5.12 Classification of information . 12
5.13 Labelling of information . 12
5.14 Information transfer . 12
5.15 Access control . 12
5.16 Identity management . 13
5.17 Authentication information . 13
5.18 Access rights . 13
5.19 Information security in supplier relationships . 13
5.20 Addressing information security within supplier agreements . 13
5.21 Managing information security in the ICT supply chain . 13
5.22 Monitoring, review and change management of supplier services . 13
5.23 Information security for use of cloud services . 13
5.24 Information security incident management planning and preparation . 13
5.25 Assessment and decision on information security events . 13
5.26 Response to information security incidents .14
5.27 Learning from information security incidents .14
5.28 Collection of evidence . .14
5.29 Information security during disruption .14
5.30 ICT readiness for business continuity .14
5.31 Legal and contractual requirements .14
5.32 Intellectual property rights .14
5.33 Protection of records .14
5.34 Privacy and protection of PII .14
5.35 Independent review of information security .14
5.36 Compliance with policies, rules and standards for information security . 15
5.37 Documented operating procedures . 15
6 People controls .15
6.1 Screening . 15
6.2 Terms and conditions of employment . 15
6.3 Information security awareness, education and training . 15
6.4 Disciplinary process . 15
6.5 Responsibilities after termination or change of employment. 15
6.6 Confidentiality or non-disclosure agreements . 15

© ISO/IEC 2025 – All rights reserved
iii
ISO/IEC FDIS 27018:2025(en)
6.7 Remote working . 15
6.8 Information security event reporting.16
7 Physical controls . 16
7.1 Physical security perimeters .16
7.2 Physical entry .16
7.3 Securing offices, rooms and facilities .16
7.4 Physical security monitoring . .16
7.5 Protecting against physical and environmental threats .16
7.6 Working in secure areas .16
7.7 Clear desk and clear screen .16
7.8 Equipment siting and protection .
...

Style Definition: Heading 1: Indent: Left: 0 cm, First line:
FINAL DRAFT INTERNATIONAL STANDARD
0 cm, Tab stops: Not at 0.76 cm
Style Definition: Heading 2: Tab stops: Not at 0.63 cm
ISO/IEC FDIS 27018:202X(E2025(en)
Style Definition: Heading 3
Style Definition: Heading 4
Style Definition: Heading 5
ISO/IEC JTC 1/SC 27 Secretariat: DIN
Style Definition: Heading 6
Style Definition: Default Paragraph Font
Voting begins on: Voting terminates on:
Style Definition: ANNEX
202X-MM-DD 202X-MM-DD
Style Definition: Comment Text

Style Definition: List Bullet: Indent: Left: 0 cm, Hanging:
ISO/IEC JTC 1/SC 27 0.63 cm, No bullets or numbering, Tab stops: 0.63 cm, List
tab
Style Definition: List Bullet 2: Indent: Left: 0.5 cm,
Secretariat: DIN
Hanging: 0.63 cm, No bullets or numbering, Tab stops:
1.13 cm, List tab
Date: 2025-05-12
Style Definition
...
Style Definition
...
Information security, cybersecurity and privacy protection — Information
Style Definition
...
security controls– Guidelines for protection of personally identifiable information
Style Definition
...
(PII) in public clouds acting as PII processors
Style Definition
...
Sécurité de l'information, cybersécurité et protection de la vie privée — Mesures de sécurité de l'information pour la
Style Definition: RefNorm
protection des informations personnelles identifiables (PII) dans l'informatique en nuage public agissant comme
Style Definition: bib_comment: Font: Cambria
processeur de PII
Style Definition: bib_deg: Font: Cambria

Style Definition: bib_suffix: Font: Cambria
Style Definition: bib_unpubl: Font: Cambria

Style Definition: cite_box: Font: Cambria
Style Definition: bib_medline: Font: Cambria

Style Definition
...
Style Definition: Body Text_Center
Style Definition
...
Style Definition: Dimension_100
Style Definition: Figure Graphic
Style Definition: Figure subtitle
Style Definition: List Continue 1
Style Definition: List Number 1: Tab stops: Not at 0.71 cm
Style Definition: Example indent 2: Tab stops: 2.39 cm,
Style Definition
...
Style Definition: Note indent 2
Style Definition: AMEND Terms Heading
Style Definition: AMEND Heading 1 Unnumbered
Formatted: zzCover, Left
Formatted: Font: 12 pt, English (United Kingdom)
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted
...
Formatted: English (United States)
Formatted
...
Formatted: Font: Arial, 12 pt, Font color: Black
Formatted: Right
Formatted: Font: Arial, 12 pt, Font color: Black

ISO/IEC FDIS 27018:202X (E)
ii © ISO/IEC 2014 – All rights reserved

ISO/IEC FDIS 27018:202X(E2025(en)
Formatted: Font: Cambria, English (United Kingdom)
Formatted: Centered
Formatted: Font: Cambria, English (United Kingdom)
Formatted: Font: Cambria, English (United Kingdom)
© ISO/IEC 20242025
Formatted
Formatted: Font: 11 pt
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no
Formatted: Font: 11 pt
part of this publication may
Formatted: zzCopyright, Adjust space between Latin and
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including
Asian text, Adjust space between Asian text and numbers
photocopying, or posting on
Formatted: Font: 11 pt
the internet or an intranet, without prior written permission. Permission can be requested from
Formatted: Font: 11 pt
either ISO at the address below or ISO's member body in the country of the requester.
Formatted: zzCopyright, Adjust space between Latin and
Asian text, Adjust space between Asian text and numbers
or ISO’s member body in the country of the requester.
Formatted: Font: 11 pt
ISO copyright officeCopyright Office
Formatted: Font: 11 pt
Formatted: Font: 11 pt
CP 401 • Ch. de Blandonnet 8
Formatted: zzCopyright, Adjust space between Latin and
CH-1214 Vernier, Geneva
Asian text, Adjust space between Asian text and numbers
Formatted: Font: 11 pt
Phone: + 41 22 749 01 11
Formatted: Font: 11 pt
Email: [e-mail]
Formatted: zzCopyright, Adjust space between Latin and
Email: [e-mail]
Asian text, Adjust space between Asian text and numbers
Formatted: Font: 11 pt
Website: www.iso.orgwww.iso.org
Formatted: Font: 11 pt
Formatted: Font: 11 pt
Published in Switzerland.
Formatted: Font: 11 pt, English (United Kingdom)

Formatted: zzCopyright, Adjust space between Latin and
Asian text, Adjust space between Asian text and numbers
Formatted: Font: 11 pt, English (United Kingdom)
Formatted: Font: 11 pt, English (United Kingdom)
Formatted: Normal, Centered, Space After: 24 pt, Tab
stops: 17.2 cm, Right
© ISO/IEC 2014 – All rights reserved iii
© ISO/IEC 2025 – All rights reserved
iii
Formatted
...
Formatted
...
ISO/IEC FDIS 27018:202X (E) Field Code Changed
...
Field Code Changed
...
Formatted
...
Field Code Changed
...
Contents Page
Formatted
...
Field Code Changed
...
Foreword . viii
Formatted
...
Introduction . x
Field Code Changed
...
1 Scope . 13
Formatted
...
Field Code Changed
2 Normative references . 13 .
Formatted
...
3 Terms and definitions . 13
Field Code Changed
...
4 Overview . 15
Formatted
...
4.1 Structure of this document . 15
Field Code Changed
...
4.2 Control layout . 23
Formatted
...
5 Organizational controls . 23
Field Code Changed
...
5.1 Policies for information security . 23
Formatted
...
5.2 Information security roles and responsibilities . 24
Field Code Changed
5.3 Segregation of duties . 24 .
5.4 Management responsibilities . 24 Formatted
...
5.5 Contact with authorities . 24
Field Code Changed
...
5.6 Contact with special interest groups . 24
Formatted
...
5.7 Threat intelligence . 24
Field Code Changed
...
5.8 Information security in project management . 24
Formatted
...
5.9 Inventory of information and other associated assets. 24
Field Code Changed
5.10 Acceptable use of information and other associated assets . 24 .
5.11 Return of assets . 24 Formatted
...
5.12 Classification of information . 24
Field Code Changed
...
5.13 Labelling of information . 24
Formatted
...
5.14 Information transfer . 25
Field Code Changed
...
5.15 Access control . 25
Formatted
...
5.16 Identity management . 25
Formatted
5.17 Authentication information . 25 .
5.18 Access rights. 25
Field Code Changed
...
5.19 Information security in supplier relationships. 25
Formatted
...
5.20 Addressing information security within supplier agreements . 25
Formatted
...
5.21 Managing information security in the ICT supply chain . 26
Field Code Changed
...
5.22 Monitoring, review and change management of supplier services . 26
Formatted
...
5.23 Information security for use of cloud services . 26
Formatted
5.24 Information security incident management planning and preparation . 26 .
5.25 Assessment and decision on information security events . 26
Field Code Changed
...
5.26 Response to information security incidents . 26
Formatted
...
5.27 Learning from information security incidents . 26
Formatted
...
5.28 Collection of evidence. 26
Field Code Changed
...
5.29 Information security during disruption . 26
Formatted
...
5.30 ICT readiness for business continuity . 26
5.31 Legal and contractual requirements . 26 Formatted
...
5.32 Intellectual property rights . 26
Field Code Changed
...
5.33 Protection of records . 26
Formatted
...
5.34 Privacy and protection of PII . 27
Formatted
...
5.35 Independent review of information security . 27
Field Code Changed
...
5.36 Compliance with policies, rules and standards for information security . 27
Formatted
...
5.37 Documented operating procedures . 27
Formatted
...
6 People controls. 27
Field Code Changed
...
6.1 Screening . 27
Formatted
...
Formatted
...
Field Code Changed
iv © ISO/IEC 2014 – All rights reserved
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
Formatted
...
Formatted
...
ISO/IEC FDIS 27018:202X(E2025(en) Formatted
...
Formatted
...
Field Code Changed
...
Formatted
...
6.2 Terms and conditions of employment . 27
Formatted
6.3 Information security awareness, education and training . 27 .
Field Code Changed
6.4 Disciplinary process . 27
...
6.5 Responsibilities after termination or change of employment . 28
Formatted
...
6.6 Confidentiality or non-disclosure agreements . 28
Formatted
...
6.7 Remote working . 28
Field Code Changed
...
6.8 Information security event reporting . 28
Formatted
...
7 Physical controls .
...