Cloud security compliance adds the questions a plain security standard leaves open: who is responsible for what between provider and customer, how personal data is handled in a public cloud, and how customers can leave. Cloud-specific standards are usually certified on top of ISO 27001, and the EU Data Act now sets legal switching rules for cloud services.
4 items in this category
3 related from other categories
Oct 30, 2026 statuses last checked
At a glance
Cloud security compliance compared
How the items in this category differ on the question that matters first: do you have to, or do you choose to?
Name
Type
Mandatory or voluntary
Where it applies
Current version
ISO 27017
Guidance
Voluntary guidance, no official certificate
Global
ISO/IEC 27017:2015.
ISO 27018
Guidance
Voluntary guidance, no official certificate
Global
ISO/IEC 27018:2025.
CSA STAR
Certifiable standard
Voluntary, with independent certification
Global
Cloud Controls Matrix (CCM) v4.1, with a published transition timeline from v4.0.
EU Data Act
Regulation
Mandatory for regulated organizations in scope
EU market
Applies from 12 September 2025. Switching charges for cloud services must end by 12 January 2027.
Directory
What each one covers and who needs it
Guidance Global
ISO/IEC 27017
Code of practice for information security controls for cloud services
ISO/IEC 27017 adds cloud-specific guidance to the ISO 27002 controls and seven extra controls for cloud services, for both cloud service providers and cloud customers. It covers shared responsibilities, removal of customer assets at contract end, segregation in virtual environments, virtual machine hardening, administrator operations, monitoring and network alignment. It is a code of practice, so organizations are certified to ISO 27001 with 27017 controls in the Statement of Applicability rather than to 27017 alone.
What it covers, who needs it and why
What it covers
Cloud provider and customer responsibilities, multi-tenancy, virtualization, admin access, logging and contract-end data return or deletion.
Who needs it
SaaS, PaaS and IaaS providers, and companies running significant workloads in public cloud.
Why it matters
It answers the cloud-specific questions that a plain ISO 27001 certificate leaves open for buyers.
Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC 27018 is a code of practice for public cloud providers that process personal data on behalf of customers. It extends ISO 27002 controls with privacy commitments a processor should make: process PII only on customer instructions, do not use it for marketing without consent, disclose sub-processors and government access requests where allowed, notify breaches, and return or delete data at the end of the contract. Like 27017 it is usually certified as part of an ISO 27001 scope.
What it covers, who needs it and why
What it covers
Personal data that a public cloud provider processes for its customers, and the transparency and control the customer gets.
Who needs it
Public cloud and SaaS providers acting as processors, especially those selling into Europe.
Why it matters
It turns processor promises into audited controls, which shortens privacy reviews in procurement.
Cloud Security Alliance Security, Trust, Assurance and Risk registry
CSA STAR is a public registry where cloud providers publish their security posture against the Cloud Controls Matrix (CCM), a cloud-specific control framework. Level 1 is a self-assessment using the CAIQ questionnaire, free to publish. Level 2 adds third-party assurance, either STAR Certification (with ISO 27001) or STAR Attestation (with SOC 2). Buyers use the registry to pre-screen vendors, and the CCM maps to ISO 27001, NIST and PCI DSS.
What it covers, who needs it and why
What it covers
Cloud controls across 17 domains, including application security, data security, identity and access, infrastructure, logging and supply chain.
Who needs it
SaaS and cloud providers that want a public, cloud-specific trust signal.
Why it matters
A published CAIQ answers many security questionnaires in advance, and Level 2 combines with audits you may already have.
Key objectives
Make cloud security transparent
Give a cloud-specific control set
Reuse existing ISO and SOC audits
Mandatory or voluntary
Voluntary, with independent certification.
Owner
Cloud Security Alliance (CSA)
Current version
Cloud Controls Matrix (CCM) v4.1, with a published transition timeline from v4.0.
Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data
The EU Data Act gives users of connected products access to the data they generate and sets rules for data sharing between businesses. For IT companies its biggest effect is Chapter VI on switching between data processing services: cloud and SaaS providers must let customers move to another provider or on premises, with set notice periods, data export, contract terms and the end of switching charges from January 2027. It also limits unfair data clauses in B2B contracts.
What it covers, who needs it and why
What it covers
Data from connected products and related services, B2B data sharing terms, switching and interoperability for cloud and edge services, and safeguards against unlawful government access.
Who needs it
Cloud, SaaS, PaaS and IaaS providers serving EU customers, and makers of connected products.
Why it matters
It rewrites standard cloud contract terms on exit, data portability and fees.
Key objectives
Fair access to data from connected products
Easier switching between cloud providers
Balanced B2B data contracts
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
European Union; national competent authorities
Current version
Applies from 12 September 2025. Switching charges for cloud services must end by 12 January 2027.
System and Organization Controls 2 report on controls relevant to security, availability, processing integrity, confidentiality or privacy
SOC 2 is an independent report, issued by a licensed CPA firm, on the controls a service organization runs to meet the AICPA Trust Services Criteria. Security is always in scope; availability, processing integrity, confidentiality and privacy are added when relevant. A Type I report covers the design of controls at one date. A Type II report also tests whether they operated effectively over a period, usually 3 to 12 months. It is an attestation, not a certificate.
What it covers, who needs it and why
What it covers
Controls over the system that delivers your service: governance and risk, access, change management, operations and monitoring, incident response, vendor management and any additional criteria you choose.
Who needs it
SaaS and cloud companies, IT service providers and data processors that sell to US and enterprise customers.
Why it matters
US enterprise buyers often require a current SOC 2 Type II report before they sign or renew, and it replaces many custom security questionnaires.
Key objectives
Describe the system and its boundaries
Show controls meet the selected Trust Services Criteria
Prove controls operated over time (Type II)
Give customers and their auditors independent assurance
Mandatory or voluntary
Voluntary, with an independent CPA report.
Owner
AICPA (American Institute of Certified Public Accountants)
Current version
Trust Services Criteria (2017), with points of focus revised in 2022. Reports follow the AICPA SOC 2 guide.
Contract requirement United States (federal government)
FedRAMP
Federal Risk and Authorization Management Program
FedRAMP is the US government program that assesses and authorizes cloud services for federal agency use. Traditionally, a provider implemented NIST SP 800-53 controls at a Low, Moderate or High baseline, was assessed by a 3PAO and gained an agency authorization. FedRAMP 20x, introduced in 2025, moves to automated, outcome-based validation with certification classes and faster reviews, and legacy Rev5 processing is winding down. Without FedRAMP, agencies generally cannot use your cloud service.
What it covers, who needs it and why
What it covers
Cloud services (SaaS, PaaS, IaaS) that process federal information, their security controls, assessment and continuous monitoring.
Who needs it
Cloud and SaaS providers selling to US federal agencies, directly or through resellers.
Why it matters
It is the entry ticket to the federal cloud market, and the program is changing fast.
Key objectives
Standard security assessment for federal cloud
Reuse of authorizations across agencies
Continuous monitoring
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
US General Services Administration (FedRAMP PMO), under the FedRAMP Authorization Act
Current version
FedRAMP 20x is the new path, with Class B and C certifications open to all providers since August 2026. Legacy Rev5 applications are accepted until 11 June 2027.
Contract requirement United States (criminal justice agencies and their vendors)
CJIS Security Policy
FBI Criminal Justice Information Services Security Policy
The CJIS Security Policy sets the minimum security requirements for accessing, storing and transmitting criminal justice information, such as fingerprints and criminal history. It applies to law enforcement agencies and every vendor whose systems or staff touch that data, through a security addendum signed by the vendor's personnel. Version 6.0 restructured the policy around NIST SP 800-53 controls, including multi-factor authentication, audit logging, incident response and security awareness training.
What it covers, who needs it and why
What it covers
Systems, cloud services and personnel with access to criminal justice information.
Who needs it
SaaS, cloud and IT vendors selling to police, courts, corrections and other criminal justice agencies.
Why it matters
Agencies cannot share CJI with a vendor that does not meet the policy, and state CJIS officers audit it.
Key objectives
Protect criminal justice information
Set common minimum controls
Vet and train personnel with access
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
FBI CJIS Division
Current version
Version 6.0 (December 2024), realigned to NIST SP 800-53 with phased requirements.
Most of these frameworks expect trained staff and records to prove it. LMS Advisor assigns the right courses by role, sends reminders, renews certificates on schedule and keeps an audit trail you can export.
Due dates, reminders and overdue reports for mandatory courses
Certificates that expire and renew on your retraining cycle
CSV, Excel and PDF exports of who completed what, and when
LMS Advisor is our product. It runs your training and keeps the records. It does not certify you against any standard.
Book a demo before Dec 1, 2026 and your quote comes with 30% off your first year of LMS Advisor: courses, proctored exams, certificates and AI authoring in one platform, in our cloud or on your own server.
Offer ends Dec 1, 2026, 11:59 PM ET
Cloud or self-hosted, proctoring included
The discount is applied in your written quote
We use cookies to see how visitors use this site and to measure our ads. Choose Continue to allow them, or Reject to browse without them. Privacy policy
LMS Advisor AI
AI product consultant
You're chatting with an AI. Answers can be wrong, so please don't type personal data here. Privacy ·
