ISO 27017 and 27018 compliance for cloud businesses
Cloud security and cloud privacy assurance, certified as an extension to your ISO 27001 certificate: we scope the extension, update your Statement of Applicability, implement the controls and sit with you through the audit. Fixed consulting fee agreed up front, delivered by certified ISO/IEC 27001:2022 Lead Implementers and Lead Auditors.
What are ISO 27017 and ISO 27018?
ISO/IEC 27017 (currently published as the 2026 edition) gives cloud-specific security control guidance for both cloud service providers and cloud customers, and ISO/IEC 27018 (2025 edition) gives guidance for protecting personally identifiable information in public clouds acting as PII processors. Neither is certified on its own: a certification body assesses both as an extension to your ISO/IEC 27001 certification, and the extensions are referenced in the certificate's scope statement.
Who this is for
When cloud security assurance is the ask
The extension is usually a commercial requirement before it is a security one. If any of these sound familiar, this is the engagement.
An enterprise customer's security review asks for cloud-specific assurance beyond your ISO 27001 certificate.
You process personal information for customers in a public cloud, and privacy due diligence keeps stalling deals.
Your SaaS or managed service runs on AWS, Azure or Google Cloud, and prospects ask how you handle your side of the shared responsibility model.
A customer contract, tender or vendor assessment references ISO 27017 or ISO 27018 by name.
You already hold ISO 27001 and want the certificate scope to cover your cloud operations and PII protection.
What you receive
What the engagement includes
Everything your certification body will ask for, built and evidenced before they arrive.
Extension scope & shared responsibility
A map of your cloud services, PII flows and the provider/customer split, so the extension scope is defensible and the shared responsibility model is documented for every in-scope service.
Statement of Applicability update
Your Statement of Applicability and risk treatment plan extended to the ISO 27017 and ISO 27018 control sets, with a justification for every inclusion and exclusion your auditor can follow.
Cloud security controls
ISO 27017 controls implemented for your environment: virtual environment isolation, administrator separation between customers, cloud asset return and deletion, and cloud service configuration management.
PII protection controls
ISO 27018 controls covering lawful processing, consent and purpose limitation, data minimisation, subprocessor terms, breach notification and data subject rights for the personal information you process in public clouds.
Internal audit
An internal audit of the extended ISMS, run the way your certification body runs theirs, with findings closed and evidence ready before the external audit.
Extension audit support
We coordinate with your certification body to assess ISO 27017 and 27018 alongside your ISO 27001 surveillance or recertification audit, and manage any nonconformities until the extensions are referenced on your certificate.
The process
How the engagement runs
Typical elapsed time from kick off to the updated certificate is six to ten weeks for an organisation already certified to ISO 27001. The audit is usually combined with your next surveillance or recertification audit, so the certification body's booking lead time affects the end date.
Weeks 1–2
Gap assessment
We benchmark your current cloud and privacy controls against the ISO 27017 and ISO 27018 guidance, and rank what blocks the extension, what carries real risk and what is merely tidy. The fixed-fee quote for the build follows from this.
Weeks 3–4
Scoping & Statement of Applicability
Cloud service and PII flow mapping, the shared responsibility split, and the updated Statement of Applicability and risk treatment plan.
Months 2–3
Implementation
Cloud-specific and PII protection controls implemented with your team and your cloud providers rather than around them, with evidence collection set up to survive the audit.
Before the audit
Internal audit & management review
The internal audit and management review covering the extended scope, with findings closed while they are still cheap to close.
Audit
Extension audit
Your certification body assesses the 27017 and 27018 control sets alongside your ISO 27001 surveillance or recertification audit. We attend, and manage any nonconformities through to the updated certificate.
Not yet certified to ISO 27001? The extension folds into your initial ISO 27001 certification programme from the start, adding only a few weeks rather than a second project.
Pricing
What ISO 27017 and 27018 compliance costs
One fixed consulting fee, quoted in writing after the gap assessment. No hourly billing.
The total cost has two lines, and only one of them is ours: our fixed consulting fee, and the certification body's audit fees. Because the extension is assessed alongside your ISO 27001 surveillance or recertification audit, the body's fees are usually a modest addition to an audit you are already paying for rather than a separate audit.
The consulting fee is fixed by scope, which is why every engagement starts with a cybersecurity gap analysis: you get a ranked remediation plan for the cloud and privacy control sets, and a fixed quote for the build. If you want a read on where you stand first, the free cybersecurity gap assessment takes a few minutes.
The ISO 27001 relationship
Extensions to ISO 27001, not standalone certificates
ISO 27017 and ISO 27018 are codes of practice: they extend the control guidance in ISO/IEC 27002 with cloud security and cloud privacy detail, but neither is a requirements standard with its own certification scheme. Nobody holds a bare ISO 27018 certificate. What you hold is an ISO 27001 certificate whose scope statement references the 27017 and 27018 control sets, and that scope statement is what enterprise customers ask to see.
In practice this means the extension work rides on the ISMS you already run: the same scope, risk assessment and Statement of Applicability, updated for the cloud and privacy controls, and audited by the same certification body alongside your ISO 27001 audit. Our ISO 27001 framework guide explains the management system the extension builds on, and the ISO 27017/18 framework guide covers the two control sets in detail.
Why CyberNinja
Why organisations choose us
Auditors build your controls
Our consultants hold ISO/IEC 27001:2022 Lead Implementer and Lead Auditor certifications, so the extension is built the way it will be audited.
Cloud and privacy specialists
We work across AWS, Azure and Google Cloud environments and align ISO 27018 controls with Privacy Act 1988 obligations, so one control set serves both the certificate and your Australian privacy duties.
Independent advice
We hold no reseller agreements and take no vendor margin, and we never issue certificates. The advice you get is the advice that fits you.
Fixed scope, fixed fee
The engagement is scoped with you after the gap assessment and quoted as a fixed fee in writing. No hourly billing, no surprise extras.
Once the extensions are on your certificate, someone has to keep the controls running between audits. Your own team can own that, or our vCISO service runs the internal audits, management reviews and risk reviews for you.
FAQ
ISO 27017 and 27018 FAQs
Prefer to read up first? Browse our Knowledge Base for compliance guides and articles.
Ready to extend your certification?
Tell us who is asking for cloud security or privacy assurance and when they need it. We will scope the extension and give you a fixed price, so you know the cost before you commit.