Cloud Certification

ISO 27017 and ISO 27018 Certification Consulting

Truvo adds the cloud security controls of ISO/IEC 27017:2026 and the cloud privacy controls of ISO/IEC 27018:2025 to your ISO 27001 ISMS, so customers see them in your certification. A senior lead guides your team from scoping through the certification body's audit.

  • Controls scoped to your role as cloud service provider and PII processor
  • Built into your existing ISO 27001 ISMS, or alongside a new one
  • Led by a senior CISSP in the US or Canada

For most SMBs, ISO 27017 and ISO 27018 consulting costs USD $2,500 to $5,000 a month to build and operate the program.

Talk to a cloud certification consultant

Share your cloud services and target certification date, and a consultant will follow up to book a call.

What does ISO 27017 and ISO 27018 certification involve?

Truvo follows the Assess, Build, Operate model, with the cloud controls built into your ISO 27001 ISMS.

Frame (8)

Assess: Cloud Scope and Gap Assessment

  • What We Do

    We map the cloud services in scope, confirm where you act as a cloud service provider and where you process PII for customers, and compare your current controls against ISO/IEC 27017:2026 and ISO/IEC 27018:2025.

  • What You Get

  • Scope Statement:
    The cloud services in scope, the split of duties with your customers, and your role as PII processor.

  • Gap Report:
    Each ISO 27017 and ISO 27018 control rated against your current practice, with the work needed to close each gap.

Frame (9)

Build: Statement of Applicability and Shared Responsibility

  • What We Do

    We extend your ISO 27001 Statement of Applicability with the ISO 27017 and ISO 27018 controls, and write down which security and privacy duties belong to you, to your customers and to your cloud providers.

  • What You Get

  • Extended Statement of Applicability:
    Every ISO 27001, ISO 27017 and ISO 27018 control marked included or excluded, with a justification.

  • Shared Responsibility Matrix:
    The owner of each control across your team, your customers and the cloud providers you build on.

Frame (10)

Build: Cloud Controls in Operation

  • What We Do

    We put the controls into daily use with your team, such as customer data segregation, administrator operations, return and deletion of customer data, sub-processor disclosure and breach notice to customers.

  • What You Get

  • Customer Commitments:
    What you tell customers about data location, sub-processors and deletion, written into contracts and service documentation.

  • Evidence Set:
    The records an auditor asks for, collected while your team operates the controls.

Frame (11)

Operate: Monitoring and Management Review

  • What We Do

    We help your team monitor the cloud controls under ISO 27001 Clause 9.1 and prepare the Clause 9.3 management review. The Clause 9.2 internal audit is a separate engagement, done by an auditor who did not build your program.

  • What You Get

  • Monitoring Records:
    Measurements your team tracks, such as completed customer data deletions, administrator access reviews and sub-processor changes.

  • Management Review Input:
    Risk changes, monitoring results and open actions, formatted for leadership sign-off.

Frame (12)

Operate: Certification Audit

  • What We Do

    We help you select a certification body that assesses ISO 27017 and ISO 27018, prepare your team for interviews, and stay with you through the audit, including responses to any nonconformities the auditor raises.

  • What You Get

  • Audit Readiness Pack:
    Documents, evidence and an interview plan organized the way the certification auditor reviews them.

  • Corrective Action Plan:
    Responses to auditor findings, each with an owner and a target date.

What do you get from an ISO 27017 and ISO 27018 engagement?

Four things you hold at the end, ready for the certification auditor.

An extended Statement of Applicability

ISO 27001 Annex A plus the ISO 27017 and ISO 27018 controls, each marked included or excluded with the justification an auditor expects to read.

A shared responsibility matrix

Security and privacy duties split between your team, your customers and your cloud providers, ready for customer security reviews.

Cloud controls with evidence

Controls your team operates day to day, with the records a certification auditor asks for.

A program ready for audit

Monitoring records under Clause 9.1 and management review input under Clause 9.3, ready for the internal audit and the certification audit.

When is Truvo the right call?

For many cloud providers, the trigger is an enterprise customer or RFP that asks for ISO 27017 or ISO 27018 alongside ISO 27001.

Right call when

  • You sell a SaaS, PaaS or IaaS service and customers ask how you protect their data in the cloud

  • You hold ISO 27001 and want the cloud controls assessed in the same certification audit

  • You process personal data for customers and want to show it under ISO 27018

  • Your team is new to ISO certification

  • Your team prefers to focus on the product while a senior lead builds the program

Wrong call when

  • You need the lowest possible price. Our pricing is competitive, but every audit is run by experienced auditors, goes through several rounds of QA and ends in a detailed report, so we are rarely the cheapest option

What do clients say about Truvo's ISO work?

"Truvo Cyber conducted our ISO 27001 and ISO 27701 internal audit. They were easy to work with, communicated clearly throughout the project, and delivered a thorough, professional report on time. I would recommend them to any organization working through similar compliance requirements."

Ellipse (1) (1)
Aimee Halbert

UserTesting

"Truvo is an instrumental and integrated part of our team...
They don’t just provide recommendations; they ensure we meet our stringent ISO 27001 and SWIFT compliance goals. We trust them with projects of national importance, and they deliver."

Mask Group-1
Matt Charette

CISO, Payments Canada

Ready to plan your ISO 27017 and ISO 27018 certification?

Book a strategy call. We review your cloud services, your ISO 27001 status and your target date, and give you a clear picture of the timeline and investment.

Book Your Free ISO Strategy Session

What do cloud providers ask about ISO 27017 and ISO 27018?

For most SMBs, ISO 27017 and ISO 27018 consulting costs USD $2,500 to $5,000 a month to build and operate the program. The monthly fee depends on the cloud services in scope, whether an ISO 27001 ISMS is already in place, and whether you add one standard or both. The certification body bills the audit fee separately.

ISO/IEC 27017:2026 gives information security controls and implementation guidance for cloud services, based on ISO/IEC 27002. It applies to cloud service providers and cloud service customers. The 2026 edition, published in July 2026, replaced ISO/IEC 27017:2015.

ISO/IEC 27018:2025 gives guidelines for protecting personally identifiable information (PII) in public clouds where the cloud provider acts as a PII processor. It builds on ISO/IEC 27002 and adds controls for processing customer PII, such as secure erasure of temporary files and notice of PII disclosure requests.

ISO 27017 covers information security for cloud services. ISO 27018 covers how a public cloud provider protects the personal data it processes for customers. Many cloud providers adopt both, because customers ask about security and privacy in the same review.

ISO 27017 and ISO 27018 are control sets, and neither is a management system standard. Certification bodies typically assess their controls as part of an ISO 27001 certification and record them on the certificate or in a separate statement. Companies without ISO 27001 can build the ISMS and the cloud controls in one program.

ISO 27018 covers PII that a public cloud provider processes for customers. ISO/IEC 27701:2025 covers a full privacy information management system for PII controllers and processors. Many cloud providers start with ISO 27018 and add ISO 27701 when customers ask for a certified privacy program. See our ISO 27701 certification consulting page.

The timeline depends on scope. Adding the cloud controls to an operating ISO 27001 ISMS is typically faster than building the ISMS and the cloud controls together, because the controls extend the same Statement of Applicability and evidence. We give you a dated plan after the scoping call.

ISO 27001 Clause 9.2 requires internal audits, with auditors selected so the audit stays objective and impartial. The audit covers the ISO 27017 and ISO 27018 controls in your Statement of Applicability. Truvo offers this internal audit as a separate service, delivered by an auditor who did not build your program.

Client data, documentation and sensitive materials are stored in secure North American cloud environments. Every engagement is led by a senior CISSP in the US or Canada with 10+ years in security, and every consultant on the engagement is an experienced, vetted professional.

How is Truvo different?

Our consultants build and operate management systems, so the cloud controls fit how your team operates the service.

The Template Approach

  • Generic Documents:
    Policy templates describe a generic cloud service. Certification auditors test whether the controls match how your team operates yours.

  • Separate Add-Ons:
    Cloud controls documented apart from the ISMS mean a second Statement of Applicability and duplicate evidence.

  • Duties Left Open:
    Without a written split of duties between you, your customers and your cloud providers, exclusions are hard to justify at audit.

The Truvo Approach

  • One Management System:
    The ISO 27017 and ISO 27018 controls extend your ISO 27001 Statement of Applicability, risk assessment and evidence.

  • Controls Tied to Your Service:
    Each cloud control maps to how your team builds, operates and supports the service.

  • Senior, Practitioner-Led:
    Every engagement is led by a senior CISSP in the US or Canada who builds and operates management systems.

Ready to certify your cloud service?

ISO 27017 and ISO 27018 consulting led by practitioners who build and operate management systems.

Book a Strategy Call

From the blog: ISO certification

Server hardware lit in blue, for OSFI B-13 technology and cyber risk

OSFI B-13 for Suppliers: SOC 2 and ISO 27001 Mapping

OSFI B-13 is the Office of the Superintendent of Financial Institutions' Technology and Cyber Risk Management guideline. B-13 has been in effect ...

Learn More
Auditor reviewing an ISO 27001 certification file at an office desk

ISO 27001 Certification in Canada: Bodies, Costs, 2026 Timeline

ISO 27001 certification in Canada is issued by an accredited certification body, a separate firm from the consultant who helps build the program. A ...

Learn More
A vibrant view of the Toronto skyline with boats on the waterfront, illustrating Top ISO 27001 Consultants in Canada (2026): A Buyer's Guide

Top ISO 27001 Consultants in Canada (2026): A Buyer's Guide

Truvo Cyber is a Canadian cybersecurity firm that implements ISO 27001 for SaaS, technology and infrastructure companies: gap assessment, ISMS build, ...

Learn More