What the two standards are
ISO/IEC 27017 gives cloud-specific guidance on the ISO 27001 controls and adds a few of its own: who is responsible for what between the cloud provider and the customer, how customer environments are separated, how the provider's administrators are controlled, how virtual machines are hardened, and how the customer can monitor the service. ISO/IEC 27018, last revised in 2025, is about personal data processed by a public cloud provider acting as a processor: using it only on the customer's instructions, never for marketing, telling the customer about requests from authorities, deleting it at the end of the contract and naming sub-processors.
What customers ask
- Whether your ISO 27001 certificate includes ISO 27017 and ISO 27018, and for which service.
- The division of responsibility between you, your hosting provider and the customer.
- How one customer's data is kept apart from another's in a shared application.
- How privileged access by your staff to customer environments is restricted and logged.
- Whether customer personal data is used for any purpose of your own, such as marketing, analytics or model training.
- How you respond to a request from a public authority for customer data, and whether you tell the customer.
- How data is returned and deleted at the end of the contract, including backups.
Answering as a vendor
If your ISO 27001 audit includes the two codes, say so and quote the scope. If it does not, answer the rows directly. Most of them are facts you already have in your security and privacy answers, phrased for a cloud service. Two answers need a clear statement of their own: tenant separation (how the application keeps one customer's data from another's) and the authority-request policy. Write both once and reuse them.
In Responsemate
These answers live in the knowledge base next to the ISO 27001 and GDPR answers they overlap with, with the certificates attached as evidence with expiry dates, and every cloud questionnaire is drafted from them with the source shown. Knowledge in Responsemate.
Questions people ask
Can we be certified to ISO 27017 or ISO 27018?
Not on their own. They are codes of practice, assessed as part of an ISO 27001 audit, and the certificate or the auditor's statement then names them. Customers read that as the ISO 27001 scope covering the cloud controls.
Do our hosting provider's ISO 27017 and 27018 certificates cover us?
They cover the infrastructure, not your application. Cite them for the rows about the data centre and the platform, and answer the rest for your own service.