Compliance FrameworksInternational
ISO/IEC 27018
Privacy in Cloud: sub-processor disclosure, cryptographic controls, component accountability.
Privacy in Cloud: sub-processor disclosure, cryptographic controls, component accountability.
| Short name | ISO 27018 |
| Region | International |
| Country or scope | International |
| Sector | Cloud |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers ISO 27018
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for ISO 27018.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for ISO 27018 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ISO27018-SUBPROC Sub-Processor Disclosure | The cloud PII processor must disclose the use of sub-contractors involved in processing, mapping to named suppliers for the software components in the service (ISO/IEC 27018 Annex A control on disclosure of sub-contracted PII processing) | Scan |
ISO27018-8.1.1 Asset Inventory for PII Systems | Assets used to process PII, including software components, must be identified and inventoried per the underlying 27002 controls (ISO/IEC 27018 applying §8.1.1, Inventory of assets) | Scan |
ISO27018-CRYPTO Cryptographic and Integrity Controls | Cryptographic controls protecting PII imply the ability to verify the integrity of the processing software via component hashes (ISO/IEC 27018 applying §10, Cryptography) | Scan |
ISO27018-12.6.1 Vulnerability Management for PII Systems | Technical vulnerabilities in systems processing PII must be managed, which requires current version information for deployed components (ISO/IEC 27018 applying §12.6.1, Management of technical vulnerabilities) | Scan |
ISO27018-ACCT Accountability Records | The processor must be able to demonstrate accountability for its processing environment, supported by dated, identifiable documentation of the software composition (ISO/IEC 27018 accountability provisions) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
A.1.1 | Consent and Choice for PII Processing |
A.2.1 | Purpose Limitation for PII |
A.3.1 | Obligation of Sub-Processors |
A.5.1 | Cryptographic Controls for PII |
A.7.1 | PII Retention and Disposal |
A.10.1 | PII Disclosure to Third Parties |
A.4.1 | Restriction of Processing |
A.9.1 | Access to PII by Cloud Service Provider Personnel |
A.11.1 | Records of PII Disclosure to Third Parties |
A.12.1 | PII Breach Notification |
A.14.1 | Availability of PII Processing Records |
A.6.1 | Data Minimisation |
Policy templates
Written for ISO 27018:
- PII Processing and Privacy Policy for Cloud Services
- PII Principal Rights and Transparency Policy
- Access Control for PII Processing Environments
And 22 from the standard set, adapted to ISO 27018.