Microsoft cloud adopts ISO27018

An interesting announcement from Microsoft that they have adopted the new ISO/IEC 27018 standard across their Azure, Office365 and Intune cloud services.

ISO describe 27018 as a "Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors", which "specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for the protection of PII which might be applicable within the context of the information security risk environment(s) of a provider of public cloud services". As a Code of Practice, and like the familiar ISO 27002 information security controls, it’s not possible to be certified as compliant against ISO/IEC 27018; however Microsoft’s Information Security Management System is certified against ISO/IEC 27001.

ENISA’s analysis of national legal requirements on cloud providers has extracted a metaframework of 27 security objectives which are mapped to the guidelines in ISO/IEC 27018 and requirements in ISO/IEC 27001. A cloud provider whose own security measures and processes are based around those standards should find it easier to demonstrate compliance with those legal requirements.