ISO 27018 Compliance

ISO 27018

ISO 27018 is the first International code of practice that focuses on protection of personal data in the cloud. It is based on ISO information security standard 27002 and provides implementation guidance on ISO 27002 controls applicable to public cloud Personally Identifiable Information (PII). It also provides a set of additional controls and associated guidance intended to address public cloud PII protection requirements not addressed by the existing ISO 27002 control set.

The AWS ISO 27018 certification can be downloaded here.

What does ISO 27018 mean to you as a customer?

Alignment demonstrates to customers that AWS has a system of controls in place that specifically address the privacy protection of their content. AWS' alignment with and independent third-party assessment of this internationally recognized code of practice demonstrates AWS' commitment to the privacy and protection of customers' content.

Does ISO 27018 matter to me as a customer if I do not handle Personally Identifiable Information (PII)?

Yes, AWS maintains the high bar of data protection and privacy controls outlined in ISO 27018 for all customer content, regardless of whether or not any particular data is PII.

Who is the independent third-party assessor?

EY CertifyPoint, an ISO certifying agent.

Can you provide a copy of the ISO 27018 code of practice?

The ISO 27018 code of practice is available for purchase online from www.iso.org.

Which AWS services are in scope for ISO 27018?

The following services are in scope for the stated regions:

What AWS data centers are in scope for the ISO 27018 assessment?

All AWS Regions and AWS Edge Locations are within the scope of the AWS ISO 27018 assessment. This includes AWS data centers in US East (Northern Virginia), US West (Oregon), US West (Northern California), AWS GovCloud (US) (Oregon), EU (Frankfurt), EU (Ireland), Asia Pacific (Singapore), Asia Pacific (Tokyo), Asia Pacific (Sydney), China (Beijing), and South America (São Paulo) that support in-scope services.

ISO 27018 Compliance Resources

Mar	APR	May
	09
2015	2016	2017