Cloud Security Compliance
Features of ISO 27017:
- It provides clarity regarding who is responsible for what between the cloud service provider and the cloud customer
- The removal/return of assets when a contract is terminated
- Protection and separation of the customer's virtual environment
- Virtual machine configuration
- Administrative operations and procedures associated with the cloud environment
- Cloud customer monitoring of activity within the cloud
- Virtual and cloud network environment alignment
Features of ISO 27018
Control and consent
The overarching principle is that the customer controls his own data. The cloud supplier is just allowed to process PII in accordance with the customer's instructions. PII can only be used for marketing and advertising purpose when the customer provides consent for it.
Security
Adhering to ISO 27018 defines restrictions on how providers may handle PII, including restriction on its transmission over public networks, storage on transportable media proper processes for data recovery restoration efforts.
Breach notification and communication:
When a data breach occurs that results into loss, disclosure or alteration of PII, ISO 27018 requires the provider to notify the customer of breach and to keep clear records about the incident.
