Neither is a management system standard, so neither is certified on its own. A cloud provider has the controls assessed as an extension of its ISO 27001 certificate, and the certificate or its scope then mentions them. 27017 covers the shared responsibilities between provider and customer, such as separating tenants and returning data when a contract ends; 27018 covers how a processor handles personally identifiable information.
The large cloud providers hold both, and buyers reviewing a cloud vendor often ask for them next to the ISO 27001 certificate. See ISO 27002.
Read more
Related terms
- ISO 27002
- ISO/IEC 27002 is the guidance standard that explains how to implement each of the information security controls listed in Annex A of ISO 27001.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.
- ISO 27701
- ISO/IEC 27701 is the standard for a privacy information management system, certifiable on its own since the 2025 edition rather than only with ISO 27001.
- Certificate scope
- The certificate scope is the statement on an ISO 27001 certificate describing which services, locations and organizational units the certification covers.