ISO/IEC 27018 extends ISO/IEC 27002 with controls for public cloud providers acting as PII processors, customer consent for processing, transparency about sub-processors and data locations, return and deletion of data, and notification of breaches.
We help you implement these controls, update customer contracts and data processing agreements, and present them to your certification body alongside your ISO 27001 audit.
Who it is for
- Public cloud and SaaS providers acting as processors
- HR, payroll, health and customer-data platforms
What you gain
- Demonstrates processor commitments to customers
- Supports GDPR processor obligations
- Pairs naturally with ISO 27017 and ISO 27701
Your path to certification
Gap assessment
We compare what you do today with every requirement and control, then give you a prioritised gap report and a realistic timeline.
Design and documentation
Scope, policies, procedures, risk methodology and records, written to fit how your teams actually work, not a template binder.
Implementation and training
We help owners put controls in place, train the people who run them and start collecting evidence.
Internal audit and management review
An independent internal audit and a structured management review prove the system works before the certification body looks at it.
Certification audit support
We prepare you for Stage 1 and Stage 2 with your chosen accredited certification body and help close any findings quickly.
Surveillance and continual improvement
Optional managed support keeps evidence current through annual surveillance audits and the three-year recertification.