NF EN ISO/IEC 27018

NF EN ISO/IEC 27018

May 2020
Standard Current

Information technology - Security techniques - Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors

This document establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect Personally Identifiable Information (PII) in line with the privacy principles in ISO/IEC 29100 for the public cloud computing environment.In particular, this document specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for the protection of PII which can be applicable within the context of the information security risk environment(s) of a provider of public cloud services.This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which provide information processing services as PII processors via cloud computing under contract to other organizations.The guidelines in this document can also be relevant to organizations acting as PII controllers. However, PII controllers can be subject to additional PII protection legislation, regulations and obligations, not applying to PII processors. This document is not intended to cover such additional obligations.

See more
View the extract
Main informations

Collections

National standards and national normative documents

Publication date

May 2020

Number of pages

36 p.

Reference

NF EN ISO/IEC 27018

ICS Codes

35.030   IT Security

Classification index

Z74-223

Print number

1

International kinship

ISO/IEC 27018:2019

European kinship

EN ISO/IEC 27018:2020
Sumary
Information technology - Security techniques - Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors

This document establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect Personally Identifiable Information (PII) in line with the privacy principles in ISO/IEC 29100 for the public cloud computing environment.

In particular, this document specifies guidelines based on ISO/IEC 27002, taking into consideration the regulatory requirements for the protection of PII which can be applicable within the context of the information security risk environment(s) of a provider of public cloud services.

This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which provide information processing services as PII processors via cloud computing under contract to other organizations.

The guidelines in this document can also be relevant to organizations acting as PII controllers. However, PII controllers can be subject to additional PII protection legislation, regulations and obligations, not applying to PII processors. This document is not intended to cover such additional obligations.

Table of contents
  • 1 Domaine d'application
  • 2 Références normatives
  • 3 Termes et définitions
  • 4 Vue d'ensemble
  • 5 Politiques de sécurité de l'information
  • 6 Organisation de la sécurité de l'information
  • 7 La sécurité des ressources humaines
  • 8 Gestion des actifs
  • 9 Contrôle d'accès
  • 10 Cryptographie
  • 11 Sécurité physique et environnementale
  • 12 Sécurité liée à l'exploitation
  • 13 Sécurité des communications
  • 14 Acquisition, développement et maintenance des systèmes d'information
  • 15 Relations avec les fournisseurs
  • 16 Gestion des incidents liés à la sécurité de l'information
  • 17 Aspects de la sécurité de l'information dans la gestion de la continuité de l'activité
  • 18 Conformité
  • Annexe A Ensemble étendu de mesures de protection des PII pour un processeur de PII d'un nuage public
  • Bibliographie
ZOOM ON ... the Requirements department
To comply with a standard, you need to quickly understand its issues in order to determine its impact on your activity.

The Requirements department helps you quickly locate within the normative text:
- mandatory clauses to satisfy,
- non-essential but useful clauses to know, such as permissions and recommendations.

The identification of these types of clauses is based on the document “ISO / IEC Directives, Part 2 - Principles and rules of structure and drafting of ISO documents ”as well as on a constantly enriched list of verbal forms.

With Requirements, quickly access the main part of the normative text!

With Requirements, quickly access the main part of the normative text!
Need to identify, monitor and decipher standards?

COBAZ is the simple and effective solution to meet the normative needs related to your activity, in France and abroad.

Available by subscription, CObaz is THE modular solution to compose according to your needs today and tomorrow. Quickly discover CObaz!

Request your free, no-obligation live demo

I discover COBAZ