ISO/IEC 27018:2025

The ISO/IEC code of practice for a public cloud provider acting as PII processor, third edition (August 2025), realigned to ISO/IEC 27002:2022: public cloud PII guidance on 13 ISO/IEC 27002:2022 controls (policy and responsibility split, PII contact, media transfer records, compromised credentials and customer-managed access, breach determination, independent evidence, awareness, disposal, customer account log-on, backup, logging, cryptography information, PII in testing) and 25 Annex A controls under the ISO/IEC 29100 principles, now marked informative (principal rights, instruction-only processing, no marketing use, temporary files, disclosure notification and records including the reason, sub-contractor disclosure, breach notification, policy retention, return and disposal, confidentiality, hardcopy, restoration logs, media, encryption in transit, user IDs, contract measures, sub-contractor contracts, pre-used storage, data location, intended destination). Supersedes ISO/IEC 27018:2019. Built from the held preview, the 2025 Annex A statements quoted in a Statement of Applicability and the complete 2019 text; the 2025 body is not held. It comprises 38 controls organised across 5 domains, and applies in International.