ISO 27017 and 27018: Cloud Security Standards for Singapore Businesses

Why Cloud Security Compliance Matters for Singapore Organisations

Singapore businesses are accelerating their move to cloud infrastructure, and with that shift comes a pressing obligation to protect data — both operational and personal. Two ISO standards sit at the centre of this obligation: ISO 27017, which provides controls specifically for cloud service environments, and ISO 27018, which establishes a code of practice for protecting personally identifiable information (PII) in public clouds. Together, they are commonly referenced as ISO 27017 and 27018 — a paired framework that addresses cloud-specific risks that the foundational ISO 27001 standard alone does not fully cover.

For Singapore organisations, this is not purely a technical matter. The Personal Data Protection Act (PDPA) places legal accountability on data controllers and processors. Meanwhile, the Workplace Safety and Health (WSH) Act and its subsidiary legislation — including the WSH (Risk Management) Regulations — require organisations to identify, assess, and control risks systematically. When cloud platforms store workforce data, incident records, or operational information, a failure in cloud security can constitute a risk management gap that regulators and auditors will scrutinise. The Ministry of Manpower (MOM) and the Workplace Safety and Health Council (WSHC) both expect documented risk controls, and cloud data handling is increasingly part of that picture.

Organisations pursuing or maintaining bizSAFE certification also benefit from aligning cloud security practices with ISO standards. A robust information security posture strengthens the overall risk management framework that bizSAFE auditors evaluate, demonstrating that your organisation treats digital risks with the same rigour applied to physical workplace hazards.

Understanding ISO 27017 and ISO 27018 in Practice

Before implementing these standards, it helps to understand what each one actually requires and how they differ.

ISO/IEC 27017:2015 extends the controls in ISO 27001 and ISO 27002 specifically for cloud computing. It addresses responsibilities shared between cloud service providers (CSPs) and cloud service customers (CSCs), covering areas such as virtual machine hardening, asset management in the cloud, and segregation of customer environments. It is relevant to both parties in a cloud relationship — meaning your organisation, as a cloud customer, has specific obligations alongside your vendor.

ISO/IEC 27018:2019 focuses on PII protection in public cloud environments. It maps closely to data protection principles found in Singapore’s PDPA, covering consent, data minimisation, transparency, and the rights of data subjects. For any organisation processing employee records, client data, or health information through a cloud platform, ISO 27018 provides a structured way to demonstrate accountability.

The practical steps below are designed for Singapore organisations — whether you are a cloud customer seeking to govern your vendors, or a service provider building compliance into your offering.

• Conduct a cloud-specific risk assessment. Under the WSH (Risk Management) Regulations, risk assessments must be documented and reviewed regularly. Extend your existing risk assessment process to cover cloud assets: identify what data is stored, who has access, and what controls your CSP applies. Map these findings against ISO 27017 Annex A controls.
• Review and formalise your shared responsibility model. ISO 27017 explicitly requires clarity on which security controls are managed by the CSP and which remain with your organisation. Document this in a shared responsibility matrix and include it in your vendor contracts.
• Implement PII controls aligned with ISO 27018. Identify all PII processed through cloud platforms — including employee data relevant to MOM reporting obligations. Apply controls such as data minimisation, purpose limitation, and retention schedules. Ensure your CSP can demonstrate ISO 27018 certification or equivalent commitments.
• Establish an incident response procedure for cloud breaches. The PDPA requires notification of data breaches to the Personal Data Protection Commission (PDPC) within three calendar days for notifiable breaches. Your incident response plan should integrate cloud-specific scenarios and assign clear ownership.
• Train staff on cloud data handling. Human error remains a leading cause of cloud security incidents. Deliver role-specific training that covers acceptable use of cloud platforms, recognition of phishing targeting cloud credentials, and escalation procedures.
• Audit your CSP’s certifications annually. Verify that your cloud providers maintain current ISO 27017 and ISO 27018 certifications. Request audit reports (SOC 2 Type II or equivalent) and review them as part of your annual vendor management cycle.
• Integrate findings into your bizSAFE risk register. If your organisation holds or is pursuing a bizSAFE Star or Level 4 certification, document cloud security risks and controls within your overall risk management system. This demonstrates a comprehensive approach that auditors expect.

Common Questions About ISO 27017 and ISO 27018

Q: Does my Singapore company need both ISO 27017 and ISO 27018, or is one sufficient?

The answer depends on what your cloud environment handles. ISO 27017 is broadly applicable to any organisation using or providing cloud services — it strengthens your general cloud security posture. ISO 27018 becomes essential when your cloud platforms process personally identifiable information, which includes employee records, customer data, or any data linked to an identifiable individual. Given Singapore’s PDPA obligations and MOM requirements around workforce data, most organisations will find that both standards are relevant. Implementing them together also avoids duplication of effort, since they share a common ISO 27001 foundation and many controls overlap.

Q: How do ISO 27017 and ISO 27018 relate to the WSH Act and workplace safety obligations?

The WSH Act and the WSH (Risk Management) Regulations require employers to identify and manage risks that could harm workers or affect the organisation’s ability to operate safely. As more safety-critical data — incident reports, risk assessments, training records, and equipment logs — moves to cloud platforms, the security of those platforms becomes a workplace risk management issue. A breach that corrupts or exposes incident records, for example, could impede MOM investigations or compromise the integrity of your WSH documentation. ISO 27017 and ISO 27018 provide a structured framework to manage these risks, which aligns with the systematic approach to risk management that MOM and WSHC expect from responsible employers.

Take the Next Step with Sage Shield

Navigating ISO 27017 and ISO 27018 alongside Singapore’s regulatory landscape — PDPA, WSH Act, MOM requirements, and bizSAFE frameworks — requires a structured approach and experienced guidance. At Sage Shield Safety Consultants, we help Singapore organisations build integrated compliance programmes that address both physical and digital risk. Whether you are starting your ISO journey, preparing for a certification audit, or reviewing your cloud vendor governance, our consultants can assess your current position and recommend a practical path forward. Book a free consultation with our team at sageshield.com/contact and let us help you build a cloud security framework that satisfies regulators, protects your people, and supports your business goals.

For the full requirements, scope and certification pathway, see our ISO 27017 vs ISO 27018 Singapore guide.