Cloud Security Compliance Standards

ISO/IEC 27001 is the international standard for an information security management system (ISMS). It requires you to define a scope, assess information security risks, choose controls from Annex A (93 controls in four themes) or elsewhere, and run a cycle of monitoring, internal audit, management review and improvement. It is voluntary, but an accredited ISO 27001 certificate is the most widely recognised proof of security for IT companies worldwide.

SOC 2 is an independent attestation report, produced by a licensed CPA firm under AICPA standards, on how a service organisation's controls meet the Trust Services Criteria for security and, optionally, availability, processing integrity, confidentiality and privacy. A Type I report tests control design at a point in time; a Type II report tests operating effectiveness over a period, usually 6 to 12 months. It is the security report most US enterprise customers ask SaaS vendors for.

FedRAMP is the US government programme that standardises security assessment and authorization of cloud products used by federal agencies. Cloud service providers implement a NIST SP 800-53 baseline (Low, Moderate or High), are assessed by an accredited third-party assessment organisation (3PAO), and receive an authorization listed on the FedRAMP Marketplace, followed by continuous monitoring. FedRAMP 20x, launched in 2025, is replacing document-heavy Rev. 5 packages with automated, machine-readable evidence.

ISO/IEC 27017 adds cloud-specific guidance to the ISO 27002 controls and seven extra controls for cloud service providers and customers, such as shared roles and responsibilities, removal of customer assets, segregation in virtual environments, virtual machine hardening and monitoring of cloud services. It is usually assessed as an extension to an ISO 27001 certification and shows customers how a cloud or SaaS provider splits security responsibilities with them.

ISO/IEC 27018 sets privacy controls for public cloud providers that process personal data on behalf of customers. It covers processing only on customer instructions, transparency about sub-processors and data locations, support for data subject requests, return and deletion of data, breach notification and restrictions on using customer data for marketing. A new edition was published in 2025. It is usually certified alongside ISO 27001 and helps cloud vendors meet GDPR processor duties.

CSA STAR is the Cloud Security Alliance's public registry and assurance programme for cloud providers, built on the Cloud Controls Matrix (CCM), a cloud-specific control framework now at version 4.1. Level 1 is a free self-assessment published in the registry using the Consensus Assessments Initiative Questionnaire (CAIQ). Level 2 adds third-party validation, either STAR Certification (with ISO 27001) or STAR Attestation (with SOC 2). It helps SaaS vendors answer cloud security questionnaires publicly.

The EU Data Act, applying since 12 September 2025, gives users of connected products and related services rights to access and share the data they generate, limits unfair data-sharing terms in contracts, and makes cloud and other data processing service providers support customer switching and remove switching charges in stages (fully by 12 January 2027). It also sets safeguards against unlawful non-EU government access to non-personal data held in the EU.