ISO 27018 is the code of practice for protecting personally identifiable information in public clouds acting as PII processors. Audited alongside ISO 27001. Add it to your engagement, close EU and enterprise procurement blockers. Starting at $4,995.
ISO 27018 is an extension on top of ISO 27001. We run them together so you ship one audit, not two.
Traditional vendors: Two separate engagements
LowerPlane: One combined audit
ISO 27018 is a code of practice, not a standalone certification. It is audited against the ISO 27001 ISMS. We map the 27018 controls on top of your Annex A controls so your auditor issues both references on a single engagement.
Traditional vendors: +$15,000–30,000
LowerPlane: Included in Growth tier
Most of ISO 27018 is implementation and documentation, not new technical work. If you already run ISO 27001, the incremental cost is in evidence tagging, DPA clauses and auditor sampling — all included.
Traditional vendors: Blocked at legal review
LowerPlane: DPA + 27018 cert in one
ISO 27018 answers the specific PII-processor concerns EU buyers raise under GDPR — consent, data location, sub-processor flow-down, breach notification. The certificate shortens procurement.
ISO/IEC 27018 is the ISO code of practice for the protection of personally identifiable information in public clouds acting as PII processors. It extends ISO 27001 Annex A with cloud-PII-specific controls.
First published in 2014 and updated in 2019, ISO 27018 was designed for public cloud providers — SaaS, PaaS and IaaS — that process personal data on behalf of their customers. It is not a standalone certification. ISO 27018 is audited as an extension of an ISO 27001 engagement, with the certification body issuing both references.
See ISO 27001 (the base framework) →The additional controls layered on top of ISO 27001 Annex A, and the evidence auditors sample.
A 4-week overlay on top of your ISO 27001 programme.
Identify which product lines process customer PII, where PII flows and which sub-processors are in scope.
Layer the ISO 27018 controls on your existing ISO 27001 policies and roll new clauses into customer DPAs.
Tag existing ISO 27001 evidence (encryption, access logs, incident runbooks) against the 27018 overlay controls.
Advisor-led readiness walkthrough, then the Stage 1 and Stage 2 audits run against ISO 27001 and 27018 together.
Companies adding the 27018 overlay to unblock EU and enterprise procurement.
Adding 27018 to our 27001 engagement took one additional week of advisor time. The certificate shut down three EU procurement blockers in the next quarter.
We thought 27018 would be a second audit. LowerPlane ran it on top of our ISMS with the same auditor, same calendar.
Our EU buyers kept asking what sub-processors we use. The 27018-aligned transparency statement answered it on the trust page and we stopped repeating ourselves on calls.
What the overlay should cost — and what it should not.
| Feature | LowerPlane | Consultant A | Consultant B | In-house |
|---|---|---|---|---|
| Added cost on top of 27001 | Included at Growth tier | +$15,000–25,000 | +$20,000–35,000 | Headcount time |
| Audit cadence | ✅ Combined with 27001 | ✅ Combined | ⚠️ Sequential | ❌ DIY |
| DPA templates | ✅ 27018-aligned pack | ⚠️ Add-on | ⚠️ Add-on | ❌ DIY |
| Sub-processor register | ✅ Live, auto-synced | ⚠️ Document | ⚠️ Document | ❌ Spreadsheet |
| GDPR Article 30 record | ✅ Reused for 27018 | ⚠️ Separate | ⚠️ Separate | ❌ DIY |
| Dedicated advisor | ✅ All plans | ✅ Billable | ✅ Billable | ❌ |
ISO 27018 is one of several privacy and security attestations EU and enterprise buyers expect from cloud providers.
The ISMS standard ISO 27018 extends. Required as the base certification.
The EU regulation whose processor obligations ISO 27018 helps demonstrate.
The US-centric attestation most enterprise buyers also ask for.
Book a 20-minute assessment. We will scope your PII processing, confirm the 27018 overlay against your current ISO 27001 posture, and lay out the combined audit path.