ISO/IEC 27017:2015 provides guidance on information security controls applicable to the provision and use of cloud services — adding 37 cloud-specific controls on top of ISO 27001/27002. It addresses both Cloud Service Providers (CSPs) and Cloud Service Customers (CSCs), clarifying security responsibility boundaries and providing controls for virtualisation security, shared tenancy, and cloud administration. ISO 27017 does not require a separate ISMS — it extends the ISO 27001 certification scope.
ISO/IEC 27018:2019 focuses specifically on protecting Personally Identifiable Information (PII) in public cloud environments — establishing privacy principles for cloud service providers acting as PII processors. It maps closely to GDPR Article 28 requirements and the DPDP Act's data processor obligations, making it highly relevant for Indian cloud providers handling EU and Indian customer data. Together, ISO 27017 + ISO 27018 + ISO 27001 form a comprehensive cloud security and privacy triplet.