ISO/IEC 27017 Cloud Security Certification in the Philippines

Extend your ISO 27001 to the cloud — and give overseas clients the cloud-security assurance they now demand

Sterling International Consulting takes Philippine organisations to ISO/IEC 27017 cloud-security assurance by implementing its cloud controls and getting them certified as part of your ISO/IEC 27001 information security management system, through an accredited certification body. Because ISO/IEC 27017 is a code of practice rather than a standalone certifiable standard, the certificate you hold is your accredited ISO/IEC 27001 certificate — now built to cover, and audited against, the cloud-specific controls your clients keep asking about. What that does for the business is concrete: it answers overseas-client and head-office cloud-security due diligence in one credible line, keeps you eligible for BPO, SaaS and technology contracts that increasingly screen for cloud assurance, and settles — in writing — exactly which security controls you own versus your cloud provider.

We are consultants, not a certification body. Sterling designs and implements the cloud controls, folds them into your ISMS, and prepares you to pass; the certificate is granted by an independent accredited certification body after its own audit. We get it done through that accredited body — and we do not put you in front of it until your system has passed our own internal audit first. That single discipline is why our clients walk into the certification audit expecting to pass, and do — not because we know a shortcut, but because we refuse to let you attempt it before the system is genuinely ready.

The business case for ISO/IEC 27017 in the Philippines

The Philippine economy runs on other people’s clouds. The BPO and IT-BPM sector, the fintechs, the SaaS companies and the back offices of overseas groups all deliver their work on infrastructure rented from AWS, Microsoft Azure, Google Cloud and regional providers. That model is efficient, scalable and, from a buyer’s point of view, opaque — which is exactly the problem ISO/IEC 27017 was written to solve.

An ISO/IEC 27001 certificate tells a client that you run a disciplined information security management system. What it does not answer, on its own, is the question every serious cloud customer now asks: how, specifically, is our data secured in the cloud environment you operate for us, and where does your responsibility end and your provider’s begin? ISO/IEC 27017 is the internationally recognised answer. It adds to ISO/IEC 27002 the cloud-specific guidance and the extra cloud controls a 27001 system does not otherwise force you to address — tenant segregation, virtual-machine hardening, administrator access, customer monitoring, and the return and destruction of data when a contract ends — converting a vague “we take security seriously” into audited evidence that your cloud posture has been independently examined.

Three commercial outcomes follow, and they show up in the pipeline rather than on a plaque:

• Market access and contract eligibility. Overseas clients, framework agreements and vendor-security questionnaires increasingly ask specifically about cloud controls — not just “are you ISO 27001 certified?” but “are your cloud services covered?” Certification with the 27017 controls in scope clears that screen; without it, an otherwise-qualified supplier gets filtered out before commercial terms are ever discussed.
• Client and buyer retention. Once a multinational customer has written cloud-security expectations into its supplier code, keeping the account depends on producing the evidence on demand. A live 27001-plus-27017 system means the answer to every cloud due-diligence request already exists — not reconstructed under deadline each time a client’s security team comes calling.
• A settled shared-responsibility position. The most expensive misunderstanding in cloud security is the assumption that “the provider handles it.” ISO/IEC 27017 forces you and your provider to document who owns which control — heading off the finger-pointing that follows an incident, shortening client audits, and turning a recurring argument into a one-page answer.

Who needs ISO/IEC 27017 in the Philippines — and what is driving demand

ISO/IEC 27017 addresses two populations separately — organisations that use cloud services and organisations that provide them — and in the Philippines both are growing fast.

Cloud service customers. The larger group by far: BPOs and IT-BPM firms running client workloads on hyperscaler platforms; fintechs and digital-payments companies whose entire product lives in the cloud; SaaS businesses; back-office and shared-service centres of overseas groups. If your clients’ data sits in an environment you rent rather than own, ISO/IEC 27017 is what lets you prove you are securing your side of it to an international standard.

Cloud service providers. SaaS vendors, managed-service providers, hosting and data-centre operators, and platform companies selling cloud services to Philippine and overseas customers. For a provider, the 27017 controls are increasingly a condition of enterprise sales — your customers need to know that tenant segregation, virtual-machine hardening, administrator security and customer-side monitoring are handled to a recognised benchmark — and certification is how you clear their security review without a bespoke negotiation every time.

Fintechs and financial-sector technology firms. Organisations supervised by, or supplying, financial institutions face heightened expectations around technology risk and cloud outsourcing. ISO/IEC 27017 on a 27001 ISMS is a clean way to demonstrate structured cloud controls to those counterparties — though you should confirm the current, specific requirements with the Bangko Sentral ng Pilipinas or the relevant regulator, since certification supports a compliance posture rather than replacing any supervisory requirement.

Cutting across all of these is the demand driver that dominates our pipeline: the overseas head office and the overseas client.

The first is the overseas parent rolling a group cloud-security standard down to its Philippine entity. Multinationals headquartered in the US, UK, Europe, Japan, Australia and Singapore run their own security programmes, and when their Manila or Cebu operation delivers work in the cloud, their security teams increasingly nominate ISO/IEC 27017 alongside 27001 as the framework they want implemented locally — a common, auditable cloud baseline across every jurisdiction. We act as the local implementation partner that turns that mandate into a certified system on the ground: coordinating with the corporate security function across time zones, delivering documentation in English, and rolling the same programme across multiple Philippine entities where a group runs more than one.

The second is the overseas client that requires cloud assurance from you as a supplier. When a foreign company outsources work to a Philippine BPO, appoints a local SaaS vendor, or places its data with a Manila-based provider, that provider becomes part of the client’s own security perimeter — and its third-party risk process may make cloud-security certification a condition of the contract. If a client has said your operation needs “cloud security certification” before they will renew or expand, ISO/IEC 27017 on top of 27001 is almost always what they mean — and producing that evidence quickly is often the difference between keeping the account and losing it to a competitor who already holds it.

If you are not certain whether the requirement in front of you actually points to cloud security, to information security more broadly, or to privacy, our Select the Standard step maps the demand to the right certification — or the right combination — before you commit to an implementation. Very often the honest answer is 27001 as the base, 27017 for the cloud dimension, and a privacy extension where personal data is involved.

What ISO/IEC 27017 actually requires — and how it is certified

Get the edition right first, because a provider that fumbles it is telling you something. ISO/IEC 27017 has been revised. The second edition has cleared its ballot and is in final production: the ISO catalogue records it as edition 2 with a publication date of July 2026, at stage 60.00 — International Standard under publication — replacing ISO/IEC 27017:2015 (verified 1 August 2026). The title changes with it. The 2015 edition was “Information technology — Security techniques — Code of practice for information security controls based on ISO/IEC 27002 for cloud services.” The second edition drops “Code of practice for” and reads “Information security, cybersecurity and privacy protection — Information security controls based on ISO/IEC 27002 for cloud services.”

What that means commercially, this month: certificates in issue reference the 2015 edition and remain valid. A certification body cannot audit you against the second edition until its accreditation body has extended its scope to cover it and transition arrangements are published. So a provider offering you an “ISO/IEC 27017:2026 certificate” today is ahead of the accreditation system, not ahead of the market — which is a reason to ask harder questions, not to sign faster. We track the stage record and the accreditation announcements under our Revise service and move your system when the window is real.

The most important thing to understand about ISO/IEC 27017 is what kind of document it is. It is a code of practice — guidance and a set of controls — not a standalone management-system standard. You do not get a separate, independently certifiable “ISO 27017 certificate” the way you get an ISO/IEC 27001 one. Instead, 27017 is implemented on top of an ISO/IEC 27001 ISMS: its cloud controls are brought into your Statement of Applicability and audited scope, and examined as an extension of the 27001 certification audit by an accredited certification body. Some certification bodies issue documentation that explicitly records the 27017 controls as covered; the certified management system, however, is your 27001 ISMS. We are precise about this because implying a standalone certificate that does not exist is exactly what an accredited audit is designed to catch.

Structurally, ISO/IEC 27017 sits on ISO/IEC 27002, the control catalogue behind Annex A of ISO/IEC 27001. It does two things:

• It adds cloud-specific implementation guidance to controls you already have. For 37 of the controls drawn from ISO/IEC 27002, it explains what “good” looks like in a cloud context — from both sides at once, spelling out the role of the provider and the customer for each. That dual perspective is the heart of the standard.
• It adds seven controls that exist nowhere else in the 27000 family. These are written specifically for the cloud, and they are where most of the real cloud risk lives.

Those seven additional cloud controls, in plain language, require you to address:

• Shared roles and responsibilities — a documented division of security duties between the cloud provider and the cloud customer, so nothing falls through the gap between “we assumed they had it.”
• Return and removal of customer assets — how a customer’s data and assets are recovered, and then securely removed, when a cloud contract ends.
• Segregation in virtual environments — keeping one tenant’s virtual environment properly isolated from another’s on shared infrastructure.
• Virtual-machine hardening — configuring virtual machines to a defined, secure baseline rather than leaving defaults exposed.
• Administrator operational security — controlling and protecting the privileged administrative operations that run the cloud environment.
• Monitoring of cloud services — giving the cloud customer the capability to monitor its own use of the service, and to detect what is happening in its own environment.
• Alignment of virtual and physical network security — managing security consistently across the virtual networks and the physical networks that underpin them.

Because ISO/IEC 27017:2015 was written against the 2013 structure of ISO/IEC 27002, and 27002 was reorganised into 93 controls under four themes in 2022, a competent implementation maps the 27017 cloud guidance onto your current ISO/IEC 27001:2022 control set rather than applying it mechanically to obsolete numbering. This is exactly where template-driven providers come unstuck and practitioner judgement earns its place — and it is why we describe the cloud controls by what they do rather than by clause numbers the second edition renumbers.

It is equally worth being clear about what 27017 does not do. It is a security standard, not a privacy one — it does not, by itself, satisfy data-protection obligations. Where the cloud holds personal data, the privacy dimension is handled by a privacy extension such as ISO/IEC 27701, and specific legal duties under the Philippine Data Privacy Act are a matter to confirm with the National Privacy Commission. And certification does not prove that no incident can ever occur; it proves that a recognised, independently audited set of cloud controls is in place and operating — exactly the evidence clients and head offices ask for.

What changes in the ISO/IEC 27017 second edition — and how to plan the transition

The architecture of the standard does not change. The base underneath it does, and that is the whole story. The 2015 edition was written against ISO/IEC 27002:2013 — 114 controls arranged in fourteen clauses. The second edition is written against ISO/IEC 27002:2022 — 93 controls arranged under four themes, organizational, people, physical and technological, with the attribute scheme that edition introduced. ISO’s own abstract for the second edition describes the same two kinds of content the 2015 edition carried: additional implementation guidance for controls specified in ISO/IEC 27002:2022, and additional controls with guidance that relate specifically to cloud services. Same design, current base.

The practical consequence is a mismatch disappearing. ISO/IEC 27001:2022 Annex A mirrors ISO/IEC 27002:2022, so from the second edition onward the cloud guidance lands on the same control identifiers your Statement of Applicability already uses. Since 2022, every competent 27017 implementation has had to bridge that gap by hand — taking the intent of the seven cloud-specific controls the 2015 edition added under its CLD. prefix (shared roles and responsibilities in a cloud environment, removal of customer assets, segregation in virtual computing environments, virtual machine hardening, administrator’s operational security, monitoring of cloud services, and alignment of security management for virtual and physical networks) and mapping it onto the 2022 control set. The second edition does that work in the standard instead of in a consultant’s spreadsheet.

That also determines how much your transition will cost you. If your 27017 controls were implemented by intent and mapped to your 2022 Annex A set, the transition is largely a mapping and documentation exercise — the controls are already operating. If someone bolted 2015 CLD. numbering onto a 2022 Statement of Applicability and left it there, the transition will expose that, and it will not be a documentation exercise. This is the difference between a system that was built and a system that was assembled from a template, and a version change is where the difference stops being theoretical.

What we are deliberately not doing is quoting the second edition’s new control numbering, or publishing a clause-by-clause mapping table, before the text is published and we have read it. Several providers will; some already are. A mapping table invented from a draft is worse than no mapping table, because clients build project plans on it. When the ISO 9001:2026 standard is in our hands, the detail goes on this page.

Four things are worth doing now, in this order. First, confirm which edition your current certificate actually references — read the certificate, not the sales deck. Second, ask your certification body two specific questions: when its accreditation will cover the second edition, and what the transition window and deadline will be. A straight answer to those two questions tells you a great deal about the body you chose. Third, re-run the mapping from cloud control intent to your current Statement of Applicability, so you know today whether you are in the first group or the second. Fourth, plan the change into your next surveillance audit rather than a special audit — transitions folded into the normal rhythm cost a fraction of transitions run as emergencies. That sequencing is exactly what Sterling Revise™ exists to run.

How Sterling delivers ISO/IEC 27017 — the Sterling OS method

We run every engagement on Sterling OS, our operating system for building management systems that pass audit and keep working afterwards. Because 27017 is an extension of your ISMS, we deliver it as one integrated 27001-plus-cloud programme, not two disconnected projects. Five components carry the work from first scoping to long-term maintenance and transition.

Design — architecting the cloud controls into your ISMS

Under Design, our consultants architect the system and guide your team to build it. We start by mapping your cloud estate honestly — which services are yours to secure, which are the provider’s, and where the shared-responsibility line falls for each platform you use. From that we build the Statement of Applicability with the 27017 controls incorporated and set the cloud-specific policies and procedures your operation needs. Our ISO gap-analysis tool gives you a fast, structured baseline before we scope the work. Design suits organisations with capable internal security or IT people who want capability transferred, not just a certificate handed over.

Drive — done-for-you, end to end

Under Drive, we develop, implement and manage the system for you — the risk assessment, the documentation, the configuration of the cloud controls into how your environment actually runs, the internal audits, the readiness work, and the coordination with your certification body. This is the route most groups working against a head-office deadline choose, and most technology companies without spare security bandwidth: you reach certification with minimal load on your own team, and with a system that genuinely operates rather than one that only looks good on paper.

Sustain — keeping the certificate alive after the audit

ISMS certification runs on a three-year cycle — an initial two-stage audit, annual surveillance, and recertification — and cloud environments change far faster than that: new services get spun up, configurations drift, providers change their platforms. Sustain keeps the system live between audits, so surveillance is a formality rather than a scramble. This is also where our internal-audit gate sits — before any audit, we test your system against the standard ourselves and close what we find, which is the mechanism behind our clients’ clean results.

Automate — Effivity and Vegam AI

Run on spreadsheets, an ISMS with cloud controls becomes an administrative burden and the evidence gets hardest to find exactly when an auditor or client asks for it. Under Automate we implement Effivity — a purpose-built management-system platform included with our consulting engagements at no additional licence cost — and apply Vegam AI to the operating workload. Your risk register, Statement of Applicability, documented information, audits and corrective actions live in one system, so producing evidence for an auditor, a client questionnaire or a head-office report is a query rather than a reconstruction.

Revise — transitions, including the 2026 ISO/IEC 27017 revision

Revise is our transition service. With the second edition of ISO/IEC 27017 approved and under publication, realigned to ISO/IEC 27002:2022, every organisation carrying the 27017 controls in scope now has a transition to plan rather than to anticipate. Revise runs it as a controlled update folded into your normal surveillance rhythm — a gap analysis against the new edition, the necessary changes to your controls and documentation, and coordination of the transition with your certification body inside its window — rather than a last-minute rush. It also handles your ISO/IEC 27001 transitions, so the base standard and the cloud extension stay current together.

Two principles hold across all five phases. First, we are a consultancy: we prepare and implement, and we get it certified through an accredited certification body — we never issue the certificate ourselves, because a firm that “issues” its own certificates is exactly the shortcut a credible security programme exists to reject. Second, we do not put you in front of the certification body until your system has passed our internal audit. Where cloud security sits inside a wider digital-trust programme — 27001, 27017, a privacy extension, SOC 2 and the rest — we build it as one coherent stack under Sterling Trust 360 rather than a pile of overlapping projects.

What drives your ISO/IEC 27017 timeline and cost

We will not quote a day-count to certification, and we are candid about why: any consultant who promises cloud-security certification in a fixed number of days is either not going through a genuinely accredited body or is planning to walk you past controls that are not really ready. Accredited audit durations are set by international rules tied to your size and complexity and cannot be compressed to a slogan. What we will give you is an honest view of the drivers that move both timeline and cost:

• Whether you already hold ISO/IEC 27001. The biggest single variable. If you already run a certified 27001 ISMS, adding the 27017 controls is a focused extension; building the ISMS and the cloud controls together from a standing start is the full programme.
• The size and complexity of your cloud estate. One provider and a handful of services is very different from a multi-cloud, hybrid environment spanning several platforms.
• Your role. Whether you are a cloud service customer securing your side, a provider certifying the service you sell, or both, changes the scope and which controls carry the most weight.
• The maturity of your current cloud configuration. Whether virtual-machine hardening, tenant segregation, administrator controls and monitoring are already in reasonable shape, or being built for the first time.
• Number of sites and entities in scope, and whether a group is certifying one Philippine operation or several at once.
• Choice of certification body and its accreditation, which sets the audit-duration and fee corridor independently of our consulting work.

Two cost points sit outside our control and we are always straight about them: the certification body’s fees are separate from Sterling’s consulting fee, and they are what they are for an accredited audit — we help you select an appropriately accredited body and scope the audit sensibly, but we never mark up or disguise their charges. Pricing is handled directly once we have scoped your situation. Tell us about your cloud estate and your client’s requirement and we will give you a proposal built on your actual scope rather than a generic figure.

Where ISO/IEC 27017 projects go wrong — and how we refuse to

We are an anti-shortcut firm, and cloud security is a field crowded with shortcuts because so much of it is invisible to the buyer until something breaks. The failure patterns are consistent.

• Treating 27017 as a standalone certificate. Providers who sell you a “27017 certification” as if it were independent of 27001 either misunderstand the standard or are hoping you do. The cloud controls are an extension of an ISO/IEC 27001 ISMS; a certificate that ignores that foundation will not survive scrutiny from a client who knows how the standard works.
• Assuming the cloud provider’s certification covers you. Your hyperscaler being ISO 27017-aligned secures their platform, not your configuration of it. The shared-responsibility model exists precisely because the customer’s side — access management, virtual-machine hardening, data handling, monitoring — is yours to secure and yours to prove. Leaning on the provider’s badge is the assumption behind a large share of real cloud breaches.
• A documentation-only system. A binder of cloud policies with no real segregation, no hardening baseline and no monitoring will not survive a stage-two auditor asking to see the controls operating — let alone an actual incident. The standard tests whether controls work, not whether they were written.
• Buying a certificate from an unaccredited body. There is a market in cheap, fast certificates from outfits with no recognised accreditation behind them. The moment a serious client checks the accreditation, the certificate fails its one real test — and signals that you tried to fake exactly the assurance you were meant to prove.
• Letting it decay between audits. A certificate earned and then neglected produces surveillance findings and, in a fast-moving cloud estate, real exposure as configurations drift. Our Sustain and Revise phases exist precisely to prevent that.

The thread through all of these is the same: the value is in the controls actually operating, and every shortcut attacks the controls to protect the certificate. That is exactly backwards, and it is the posture our entire method is built to reject.

Why organisations choose Sterling for ISO/IEC 27017

Sterling International Consulting has been built over more than 20 years and is trusted by more than 8,100 clients across 60-plus countries. We are not a certificate broker and not a template mill, but practitioners who implement management systems that work and pass audit at accredited bodies — and in cloud security, where the whole point is to be genuinely, not cosmetically, in control, that distinction is the entire value.

• We deliver 27017 as part of a real ISMS. Because we run ISO/IEC 27001 as our core practice, we build the cloud controls into a genuine, certifiable management system — not a bolt-on certificate with nothing underneath it.
• An honest, accredited-certification-body process. We prepare and implement; the certificate is granted by an accredited certification body after its own independent audit. We help you choose a properly accredited body and keep our advisory role independent of the certification decision — the independence that makes the certificate worth holding.
• A certification success record we can explain by mechanism. Our clients do not fail their audits, and the reason is not a marketing line: we do not put you in front of the certification body until your system has passed our own internal audit. If it is not ready by our standard, it does not go forward — so when it does, it passes.
• Depth across the digital-trust stack. Cloud security rarely stands alone. Because we run information security, privacy and the wider assurance frameworks together, we can build 27017 alongside ISO/IEC 27701 privacy, SOC 2 and the rest as one coordinated programme under Sterling Trust 360 — shared audits, shared evidence, one management review, rather than a stack of disconnected certificates.
• Counsel that tells you the truth. We will tell you when 27017 is not quite what your client is asking for, when the base 27001 certificate already answers the requirement, or when privacy is the real gap. Anti-shortcut is not a slogan here; it is why clients from sixty-plus countries stay with us across successive recertifications.

Frequently asked questions about ISO/IEC 27017 in the Philippines

Can we get certified to ISO/IEC 27017 on its own, or do we need ISO/IEC 27001 first?

You need ISO/IEC 27001. ISO/IEC 27017 is a code of practice — a set of cloud-specific controls and guidance — not a standalone management-system standard, so there is no independent “27017 certificate” the way there is a 27001 one. Its controls are built into your ISO/IEC 27001 ISMS and audited as part of, or an extension to, the accredited 27001 certification. If you do not yet hold 27001, we build the ISMS and the cloud controls together; if you already hold it, we add 27017 as a focused extension.

What is the current edition of ISO/IEC 27017 — and has the new version landed?

Two editions matter right now. ISO/IEC 27017:2015 is the edition your certificate references, and it remains valid. The second edition has been approved and is in final production: the ISO catalogue shows edition 2 with a July 2026 publication date at stage 60.00, International Standard under publication, replacing the 2015 edition (verified 1 August 2026). It is rebased on ISO/IEC 27002:2022. Until accreditation bodies extend certification-body scopes to the new edition and publish transition arrangements, no accredited certificate can cite it — so treat any offer of a “27017:2026 certificate” today with caution. We track the stage record under our Revise service and move your system when the window opens.

We already have ISO/IEC 27001 — how much extra work is adding 27017?

Far less than building from scratch, because the foundation is there. Adding 27017 means bringing the cloud-specific guidance into your existing Statement of Applicability and audited scope, and standing up the additional cloud controls — shared responsibility, tenant segregation, virtual-machine hardening, administrator security, customer monitoring, asset return and network alignment — where they are not yet covered. For an organisation with a mature 27001 ISMS and a well-run cloud estate, it is a contained extension: the effort scales with your cloud environment, not with the whole management system again.

Our overseas client is asking for “cloud security certification” — is ISO/IEC 27017 what they mean?

Almost always, yes — usually ISO/IEC 27017 on top of ISO/IEC 27001. When a foreign client outsources work or data to a Philippine operation, its third-party security process wants evidence that your cloud services are secured to a recognised standard, and 27017-in-scope is the internationally understood way to give it. Send us exactly what the client specified and we will confirm whether 27017 is the right answer, whether the base 27001 certificate already covers it, or whether a privacy extension is also needed.

We run our clients’ workloads on AWS, Azure or Google Cloud — doesn’t the provider’s certification already cover us?

No, and this is the most costly misunderstanding in cloud security. Your provider being ISO 27017-aligned secures their platform; it does not secure your configuration of it. Under the shared-responsibility model at the heart of the standard, the customer’s side — identity and access management, virtual-machine hardening, data handling, monitoring of your own environment — is yours to secure and yours to prove. ISO/IEC 27017 exists precisely to document that line and demonstrate you are meeting your half of it.

Does Sterling issue the ISO/IEC 27017 certificate?

No, and it is important that no consultancy claims to. Sterling designs and implements the cloud controls, folds them into your ISO/IEC 27001 ISMS, and prepares you to pass. The certificate is granted by an independent, accredited certification body after its own audit — we get it done through that accredited body. Keeping those roles separate is what makes the certificate credible; assurance “issued” by the same firm that built the system would not be worth holding.

How long does it take, and what will it cost?

We will not quote a fixed day-count: a real timeline depends on whether you already hold ISO/IEC 27001, the size and complexity of your cloud estate, whether you are a customer or a provider, and the maturity of your current configuration. Accredited audit durations are set by international rules and cannot be compressed to a slogan. Cost follows the same factors, plus the certification body’s own fees, which are separate from our consulting fee. Give us your scope and we will provide an honest proposal rather than a number pulled from the air.

Is ISO/IEC 27017 mandatory in the Philippines?

No — no Philippine law requires ISO/IEC 27017 to operate. What makes it close to essential in practice is commercial: overseas clients, group head offices and enterprise buyers write cloud-security expectations into their supplier requirements and third-party risk processes. Financial-sector counterparties may expect structured cloud controls as part of technology-risk and outsourcing due diligence — confirm the specifics with the Bangko Sentral ng Pilipinas or the relevant regulator, since certification supports a compliance posture rather than replacing any supervisory rule. It is rarely legally required and increasingly commercially unavoidable — a distinction we always draw honestly.

What is the difference between ISO/IEC 27017, ISO/IEC 27018 and ISO/IEC 27701?

They address different things and are easy to conflate. ISO/IEC 27017 is about cloud security — controls for securing cloud services, for both providers and customers. ISO/IEC 27018 — now in its third edition, ISO/IEC 27018:2025, published August 2025 and also rebased on ISO/IEC 27002:2022 — gives guidelines for protecting personally identifiable information handled by public-cloud providers acting as PII processors. ISO/IEC 27701 is the broader privacy extension to ISO/IEC 27001 — a certifiable privacy information management system for how your whole organisation handles personal data. Many cloud-based Philippine organisations need 27001 as the base, 27017 for cloud security, and 27701 for privacy. We tell you which your actual requirement calls for rather than selling all three by default.

Does ISO/IEC 27017 help us comply with the Data Privacy Act and the NPC?

It helps, but it is not the whole answer. ISO/IEC 27017 strengthens the security of the cloud environment where personal data may be held, which supports the security-measures dimension of data-protection compliance — but it is a security standard, not a privacy management system, and it does not by itself discharge your obligations under the Philippine Data Privacy Act. For privacy specifically, the right instrument is a privacy extension such as ISO/IEC 27701, and you should confirm your current legal obligations with the National Privacy Commission. We build the security and privacy pieces so they reinforce each other rather than leaving a gap between them.

How do we make sure the certificate is genuinely accredited and recognised overseas?

This question separates a valuable certificate from a worthless one, and you should ask it before engaging anyone. Because 27017 is certified through your ISO/IEC 27001 ISMS, what matters is that the certificate comes from a certification body accredited by a recognised accreditation body — a member of the international mutual-recognition arrangement such as the Philippine Accreditation Bureau, UKAS, ANAB or JAS-ANZ. We help you select an appropriately accredited body and keep our advisory role independent of the certification decision. If a certificate cannot be traced to a recognised accreditation body, treat it as decoration, not evidence — because that is exactly how your client’s security team will treat it too.

Last updated: July 2026 · Reviewed by Ann Reyes, Lead Auditor (Davao), Sterling International Consulting.