A Management System for the Cloud – Why Your Organization Should Consider ISO 27018

By Alex Hsiung, Senior Associate, Schellman & Co.

Cloud computing technologies have revolutionized the way organizations manage and store their information. Where companies used to house and maintain their own data, a host of organizations have now made the switch to a cloud-based model due to the ease of use and cost-saving benefits promised by the cloud.

But what is a cloud without a little rain? The benefits of cloud technologies have not come without their costs.

Within the world of cloud computing, there have been three persistent concerns:

1. Security
2. Security
3. Security

A quick search for the pitfalls and concerns organizations face with cloud computing yields a recurring motif. Every company looking to incorporate a cloud-based service has to weigh the benefits that a cloud environment affords against the risks associated with entrusting an organization with its sensitive data. This data tends to include personally identifiable information (henceforth referred to as PII), which is generally the most scrutinized category of data and is subject to some of the strictest legal and regulatory requirements.

Customers of cloud service providers want to rest assured that the PII they have entrusted a cloud service provider with is maintained and held to at least the same level of security standards that they would have placed if the data had remained within their control. For some organizations, the stakes are even higher as this is mandated by certain legal and regulatory requirements such as the Health Insurance Portability and Accountability Act (HIPAA) for electronic personal health information and the Graham-Leach-Bliley Act (GLBA) for sensitive financial information.

Many cloud service providers maintain that they are ignorant to the data ingested on behalf of their customers. However, in the event of a security breach involving either personal health information or sensitive financial data, significant fines and reputational damage can be incurred by the cloud service provider if appropriate security and privacy measures are not in place. This is where an effective information security management system, with specific control considerations tailored to cloud security and privacy surrounding PII, can prove invaluable to a cloud service provider.

You may have questions regarding what an information security management system is. To define an information security management system, it may be easier to first understand what it is not. An information security management system is not referring to an actual “system”, “application”, or “tool” that performs information security functions.

A broader definition is as follows: an information security management system represents the organization’s holistic approach to addressing information security concerns. This includes top management’s buy-in to addressing these risks which can be demonstrated in its actions by performing the following:

• Fostering a top-down approach to information security that encourages personnel throughout the organization to be aware of information security best practices
• Performing risk assessments that are tailored to its organization’s unique threats and vulnerabilities
• Proactively searching for issues and concerns through the use and selection of internal auditors
• Monitoring and measuring the performance and effectiveness of the information security management system
• Establishing a commitment to continually improving the information security management system
• Ensuring that security controls are implemented and applicable to its organization’s goals and purpose

The standard most commonly used to demonstrate an organization’s effective implementation of an information security management system is the ISO 27001 standard. The ISO 27001 standard serves as a baseline framework which virtually all service providers, cloud-based or otherwise, can work toward implementing. It is worth noting that ISO 27001 provides a multitude of benefits to organizations that implement an effective information security management system, but two are perhaps the most pertinent and deserve to be mentioned:

• An effective information security management system demonstrates to prospective and current customers that the service organization means business about protecting the data that it is entrusted with and responsible for.
• An effective information security management system assists organizations with establishing a forward-thinking, proactive approach to addressing information security concerns as opposed to enabling a backward-looking mindset which is generally fostered by audit culture, which typically focuses on historical information.

The above-mentioned points may be enough for any service organization to consider implementing an information security management system. The reputational benefit that an organization can enjoy by demonstrating to its customers that it takes its handling of information seriously is difficult to measure. The cost-savings that an organization can enjoy by implementing effective response procedures in the event of a security incident are also incalculable – just ask United Airlines. Sure, maybe that was a different kind of incident, but the age-old adage remains: failing to prepare is preparing to fail – this is the essence of ISO.

However, the buck does not stop at ISO 27001, especially for cloud service providers who by virtue of their trade must take information security more seriously. This is where organizations can implement, in addition to the requirements held forth by the ISO 27001 standard, a slew of measures to increase the security and privacy measures in place when handling sensitive data, such as PII. This standard is referred to as ISO 27018, which can be achieved in tandem with an effective information security management system in accordance with the ISO 27001 standard.

ISO 27018, otherwise referred to as ISO/IEC 27018:2014, builds upon an organization’s information security management system by establishing a group of privacy-based controls that are dedicated to protecting PII in public clouds that act as PII processors, with an emphasis on protecting PII in the cloud. ISO 27018 provides a new subset of controls dedicated to the protection of sensitive personal data.

A high-level overview of some of the ISO 27018 requirements are included below:

• Providing cloud customers with the ability to access, correct, and erase their own PII
• Ensuring that data is processed according to its intended purpose and not taken out of context
• Procedures for the deletion of temporary files
• Implementing defined disclosure procedures
• Providing open, transparent notice in the event that sub-contractors are utilized
• Encouraging accountability on behalf of the cloud service provider through the implementation of breach notification procedures
• More stringent information security requirements on the part of the cloud service provider

Hopefully after considering the above, it is more clear that implementing an information security system aligned with ISO 27001 is tremendous for a service organization, but for cloud service providers hoping to assuage any security and privacy concerns for their customers, aligning these controls with ISO 27018 may be the organization’s best option.

As the technologies around us evolve, so do their underlying threats and vulnerabilities. An effective information security management system affords an organization a proactive, forward-thinking approach to information security. This is all the more important given that cloud computing technologies have been plagued with security and privacy concerns since their inception; the risks will only continue to increase.

If you represent a cloud service provider, it may be time to consider how your organization can benefit from the implementation of an information security management system that aligns its 27001 controls with the ISO 27018 objectives.

For more information on ISO 27018, you can view our webinar on-demand: Privacy in the Cloud - an introduction to ISO 27018