Duration
1 day
What is ISO/IEC 27018:2019 standard?
ISO/IEC 27017:2015 is a code of practice that focuses on protection of personal data in the cloud. It is based on ISO/IEC information security standard 27002 and provides implementation guidance on ISO/IEC 27002 controls applicable to public cloud Personally Identifiable Information (PII).
The protection of PII from both internal and external threats is a major concern for every organization, especially when held in the Cloud. This increases the requirement to have effective cloud security controls in place to address the risk to PII. That’s where ISO/IEC 27018 can help.
If you’ve already got an understanding of ISO/IEC 27001 and ISO/IEC 27002 and need to understand or implement the ISO/IEC 27018 security controls then this course is for you.
Course Overview
This one-day course is designed for participant to understand ISO/IEC 27018 and use this standard as a reference for selecting PII protection controls when implementing a cloud computing information security management system based on ISO/IEC 27001. The participants will be to understand what are the commonly accepted PII protection controls for organizations acting as public cloud PII processors.
Course Objectives
On successful completion of this course the participants will be able to learn:
- What is PII and how it affects Public Cloud
- What is PII protection requirements
- Benefits of implementing ISO/IEC 27018:2019
- Information security risks encounter in public cloud services in relation to PII
- Understand structure and controls applicable to public cloud services based on ISO/IEC 27018:2019
- How to select and implement controls in a cloud computing environment
- Examine and select controls from ISO/IEC 27018:2019 based on risk assessment, through case studies
Training Style
This course is designed and delivered based on the competency-based training concepts, which includes lectures, group discussion, and workshops.
Who Should Attend?
This course is recommended for
- Cloud service consumers or cloud service providers handling PII
- IT managers responsible for delivering or running public cloud-based systems
- Chief Information Officers or delegates
- Information Security Officers
- Information Technology Professionals
- Cloud/Information Security Auditor
- Anyone who manage information security controls
Prerequisites
Participants should have a good knowledge of ISO/IEC 27002:2013, ISO/IEC 27001:2013 and ISO/IC 27017:2015, as well as the key principles of ISMS.
Introduction
- Background and context
- PII protection requirements
- Selecting and implementing controls in a cloud computing environment
- Exploring ISO/IEC 27018:2019 standard – the Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
- Terms and definitions
Overview
- Structure of this document
- Control categories
- Annex A Public cloud PII processor extended control set for PII protection
- Consent and choice
- Purpose legitimacy and specification
- Collection limitation
- Data minimization
- Use, retention and disclosure limitation
- Accuracy and quality
- Openness, transparency and notice
- Individual participation and access
- Accountability
- Information security
- Privacy compliance
- Discussions
Programme scope, delivery arrangements and suitability are confirmed during enquiry.