ISO 27018 checklist: 12 points and the evidence behind them

ISO 27018:2019 applies if you process personal data on behalf of customers in a public cloud. It extends ISO 27001 with privacy controls: purpose limitation, deletion and return, sub-processors and breach notification. It supports your obligations under the GDPR and the Swiss FADP.

The list below follows the management system clauses 4 to 10, the same high level structure as ISO 27001. A table after it covers the six privacy requirements. For each point you get the question to answer and the evidence a customer auditor would ask to see.

Evidence does not need to be elaborate. A signed policy, a register, a log extract or a contract is enough, as long as it exists and is current.

• ISO 27001 for comparison
• ISO 27017 for cloud security

These clauses fix what you are certifying and who answers for it. Most missing evidence here is simply unwritten.

1. 01

   Scope of the cloud service (clause 4)

   You can state which services you run as processor and which customer PII they hold. Evidence: a scope statement and a service description.

2. 02

   Legal requirements (clause 4)

   You know which rules apply, such as the GDPR and the Swiss FADP. Evidence: a register of legal requirements and your standard data processing agreement.

3. 03

   Responsibility for privacy (clause 5)

   Management has named a person accountable for PII in the cloud service. Evidence: a signed privacy policy, a role description, meeting minutes.

4. 04

   Risk assessment covering PII (clause 6)

   Risks to customer data are rated and have owners. Evidence: a risk register with PII entries and a treatment plan.

5. 05

   Data protection impact assessments (clause 6)

   You have a method for assessing processing with a high risk to individuals. Evidence: a DPIA template and at least one completed assessment.

6. 06

   Privacy objectives (clause 6)

   You measure something concrete, for instance how fast deletion requests are handled. Evidence: objectives with an owner and a target date.

This is the part of the checklist that shows day-to-day practice. Reviewers look for records, not for statements of intent.

1. 01

   Trained staff (clause 7)

   Everyone with access to customer PII knows the rules and is bound to confidentiality. Evidence: training records and signed confidentiality agreements.

2. 02

   Controlled documents (clause 7)

   Policies and procedures have an owner, a version and a review date. Evidence: a document register with version history.

3. 03

   Operating controls (clause 8)

   Access rights, logging, deletion and data return work as described. Evidence: access review records, deletion logs, an export procedure.

4. 04

   Sub-processors (clause 8)

   You know every sub-processor that touches customer PII and have a contract with each. Evidence: a current sub-processor list and the signed agreements.

5. 05

   Internal audit and management review (clause 9)

   Someone has checked the system against the standard and management has discussed the result. Evidence: an audit report and review minutes.

6. 06

   Incidents and corrective action (clause 10)

   Breaches are logged, reported and followed by a fix. Evidence: an incident log, a breach notification procedure, corrective action records.

These are the points that appear in supplier questionnaires from customers who use your cloud service. Answer each question with a document you can open in under a minute.

Small cloud and SaaS providers usually have the technical controls in place. The shortfall is in proof.

Deletion cannot be shown

The database row is gone, but no log or ticket records who requested it and when. Keep a simple deletion register.

Outdated sub-processor list

A hosting or email provider was added last year and never entered. Review the list every quarter.

Untested breach procedure

The steps exist on paper, but nobody has run through them. A short tabletop exercise gives you a record.

No named owner

Privacy sits with everyone and therefore with nobody. One name in the policy closes this gap.

The Zertify self-assessment for ISO 27018 has 32 yes/no questions. Eleven of them are mandatory requirements of the standard and must all be answered yes. Among the other 21, at least 14 must be yes. If your checklist is mostly ticked, you will pass.

There is no on-site audit. G6 Agency AG issues the certificate under licence from SICE, and SICE reviews every assessment before it is issued. After you pass and pay, the certificate arrives within 4 hours. Each one carries a number and a QR code, so your customer can check it on the public verification page.

The price is CHF 799 (€799) in the first year, then CHF 529 (€529) per year including the yearly online re-audit. The certificate is valid for 3 years. You can buy without an account.

• Start the free self-assessment
• ISO 27018 at Zertify
• See pricing and discounts
• Compare the certification routes