ISO 27017 vs 27018: What Vendors Actually Publish

Trust centres love a wall of badges, and ISO 27017 and ISO 27018 are two of the most common logos sitting next to ISO 27001. The trouble is that neither standard has its own certification scheme. Both are written as supplementary guidance that extends ISO/IEC 27002, the control catalogue underneath ISO/IEC 27001, so a vendor cannot hold a freestanding "ISO 27017 certificate" or "ISO 27018 certificate" in the way it holds an ISO 27001 certificate. What actually happens is an extension: a certification body audits the extra controls and then widens the scope statement on the existing ISO 27001 certificate, or issues a supplementary document that cites the base certificate number. If a vendor's trust centre shows the two logos but gives you no certificate number, no scope statement and no way to check a registry, you are looking at marketing, not evidence.

What ISO/IEC 27017 and 27018 actually cover

ISO/IEC 27017:2015 is a code of practice for information security controls specific to cloud services. It takes the ISO/IEC 27002 control set and adds cloud-specific implementation guidance plus a handful of entirely new controls, covering things like who is responsible for configuring a shared virtual environment, how assets are returned or deleted when a cloud contract ends, and how a cloud service customer's administrative access is segregated from the provider's own staff. It applies to both cloud providers and cloud customers, which is why the standard writes guidance for each side of the relationship separately.

ISO/IEC 27018:2019 narrows the focus to privacy. It extends the same ISO/IEC 27002 base with controls for organisations acting as a processor of personally identifiable information in a public cloud. That means controls on notice and consent, disclosure of where data is stored and processed, rules on using subcontracted processors, and obligations to return or delete personal data at the end of a contract. It sits closer to ISO/IEC 27701 in intent, though 27701 is a full privacy information management system and 27018 is a narrower, cloud-specific code of practice.

Why neither standard is certifiable on its own

Accredited certification bodies issue certificates against management system standards, which have a defined structure of clauses, a required Statement of Applicability (SoA), and a surveillance audit cycle. ISO/IEC 27001 has that structure. ISO/IEC 27017 and 27018 do not. They are code-of-practice documents, meaning they tell an organisation what good controls look like but do not define a management system to be audited in isolation. A certification body cannot run a standalone audit against 27017 and hand out a certificate for it, because there is no accreditation scheme set up to do that.

What certification bodies do instead is extend an existing ISO/IEC 27001 audit. During the same audit cycle, assessors test the organisation's SoA against the additional 27017 or 27018 control sets. If the organisation passes, the certificate's scope statement is updated to name the extension explicitly, for example "including ISO/IEC 27017:2015 and ISO/IEC 27018:2019 for cloud services". Some certification bodies issue this as a short supplementary certificate referencing the base ISO 27001 certificate number rather than editing the original document. Either way, there is always a parent ISO 27001 certificate underneath. A vendor cannot show you 27017 or 27018 coverage without also being able to show you the ISO 27001 certificate it attaches to.

0

Standalone 27017 or 27018 certification schemes

Both standards extend an existing ISO/IEC 27001 scope rather than being audited independently.

31 Oct 2025

IAF MD 26 transition deadline

Certificates still citing the ISO/IEC 27001:2013 edition lapsed on this date, which also affects any 27017 or 27018 extension attached to them.

2

Sides of the relationship ISO 27017 addresses

The standard writes separate guidance for the cloud service provider and the cloud service customer.

The practical difference between 27017 and 27018

Buyers often ask for "27017 and 27018" as a pair because cloud vendors tend to pursue both extensions together, but they answer different questions. 27017 is about securing the cloud service itself. 27018 is about what happens to personal data once it is inside that service. A vendor can reasonably hold one without the other, for example a cloud infrastructure provider with no direct access to customer personal data might carry 27017 but have less reason to pursue 27018.

How a certification body actually extends the scope

1. 1

   Base audit against ISO/IEC 27001

   The organisation holds or is pursuing certification against the 2022 edition of the management system standard. Certificates still citing the 2013 edition lapsed on 31 October 2025 under IAF MD 26, so an extension attached to a lapsed base certificate is not current evidence of anything.
2. 2

   Additional control assessment

   Auditors test the organisation's Statement of Applicability against the relevant 27017 or 27018 control set, checking which of the additional controls are marked applicable and how they are implemented in practice.

3. 3

   Scope statement update

   If the organisation passes, the certification body updates the ISO 27001 certificate's scope wording, or issues a short supplementary document that names the base certificate number it extends.

4. 4

   Public register entry

   Many certification bodies maintain their own public register of issued certificates. The entry for the extension should be searchable there, independent of anything the vendor publishes on its own trust centre.

What to actually check on a vendor's page

This is the same discipline covered in how to read a trust centre: a badge wall tells you what a vendor wants to claim, the underlying document tells you what was actually audited. The same applies to the broader question of which framework to ask for when a report and a certificate are both on offer, since a SOC 2 report and an ISO 27001 certificate (with or without a 27017 or 27018 extension) answer different procurement questions and are not interchangeable.

Reading the extension on a real vendor page

Docebo's trust centre is a useful case because it lists ISO 27001, 27701, 27017 and 27018 together rather than as a single generic "ISO certified" badge. The point of the card below is not the vendor's specific certificate number, it is the pattern to look for: whether the 27017 and 27018 references sit inside the same scope statement as the ISO 27001 entry, whether the edition referenced is current, and whether the certifying body is named and checkable. Treat the layout as a template for reading any vendor's cloud-extension claims, not as a verdict on this one.

Docebo · Trust report

Education · Public evidence as of 12 Oct 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 2 verified, 9 vendor-stated.

• ISO 27017Vendor-statedTrust centre · 30 Sep 2026
• FedRAMPVerifiedModerate impact
• DPFVerifiedValid to 30 Dec 2026
• SOC 2Vendor-statedTrust centre · 30 Sep 2026
• GDPRVendor-statedTrust centre · 30 Sep 2026
• PCI DSSVendor-statedTrust centre · 30 Sep 2026
• ISO 27001Vendor-statedTrust centre · 30 Sep 2026
• ISO 27701Vendor-statedTrust centre · 30 Sep 2026
• ISO 27018Vendor-statedTrust centre · 30 Sep 2026

2 more frameworks on the evidence page

5Documents and agreements

Legal and review documents Docebo publishes or offers, as of 30 Sep 2026.

• Standard contractual clauses · On request
• Subprocessor list · Public
• Privacy policy · Public
• AI and data use policy · Public
• Public trust centre documents · Docebo SOC2 Report Renewal Statement (Bridge letter); Docebo ISO 27001, 27701, 27017, and 27018 latest certificate; Docebo ISO 9001 Certificate

2Security practices

Public statements from Docebo, shown as statements, not attestations, as of 30 Sep 2026.

• Penetration testing · annual
• Data residency · Australia, Canada, EU, India, US

1Subprocessors

Named on Docebo's public subprocessor list, last seen 30 Sep 2026.

• List of all Docebo sub processors

AWS, hyperscalers and the "ISO 27017 certified" shorthand

Large cloud providers are usually where buyers first meet ISO 27017 and 27018, because AWS, Microsoft and Google all publish extensions alongside their ISO/IEC 27001 certification. The standard's own description makes clear what the extension is actually for:

ISO/IEC 27017:2015 gives guidelines for information security controls applicable to the provision and use of cloud services by providing additional implementation guidance for relevant controls specified in ISO/IEC 27002 and additional controls with implementation guidance that specifically relate to cloud services.

That wording matters because it confirms the standard is additional guidance attached to a base control set, not a freestanding scheme. When AWS or any other hyperscaler says it holds ISO 27017, the useful question is which services and regions the certificate scope actually covers, since major providers typically scope certificates to specific service lists rather than their entire platform. The certificate document, available through each provider's own compliance portal, states this explicitly. A sales page that simply says "ISO 27017 certified" without naming a scope is making a claim that the underlying document may only partially support.

Where this fits with the wider ISO 27001 picture

Any 27017 or 27018 claim is only as strong as the ISO 27001 certificate it rides on. The 2022 transition deadline closed out certificates still referencing the 2013 edition on 31 October 2025, and the index saw vendor pages that had not caught up with that change. A cloud extension attached to a lapsed base certificate is not current evidence, regardless of how recent the trust centre badge looks. Check the base certificate's edition and expiry before trusting anything built on top of it, and treat the ISO 27001 Annex A supplier controls listed in the regulations index as the baseline the cloud extensions are layered onto.

• Look for the certificate number and issuing certification body, not just a logo.
• Confirm the ISO/IEC 27001 edition cited is 2022, since 2013-edition certificates lapsed on 31 October 2025.
• Check whether the scope statement names 27017 or 27018 explicitly, rather than listing a generic 'ISO certified' line.
• Check the certifying body's own public register where one exists, rather than relying on the vendor's own page.
• If the vendor also claims ISO/IEC 27701, confirm whether that is a separate privacy information management system certificate rather than the same 27018 extension restated.