ISC2 Certified Cloud Security Professional (CCSP) Practice Question

ISO/IEC 27018 is the first international code of practice that focuses on protection of personally identifiable information (PII) in public cloud computing environments where the service provider acts as a PII processor. Certification against ISO/IEC 27001 or compliance with ISO/IEC 27017 shows that the provider follows general information security management or implements cloud-specific security controls, but these standards do not focus on privacy requirements for PII. ISO/IEC 19086 addresses service-level agreements, and ISO/IEC 27036 concerns information security for supplier relationships. Therefore, requiring ISO/IEC 27018 is the most appropriate way to obtain assurance that the CSP implements privacy-specific controls for handling PII in the cloud.