1. Geneva, Switzerland, 14 November 2014 Data Protection for Public Cloud (International Standard ISO 27018) Stéphane Guilloteau Engineer Expert, Orange Labs stephane.guilloteau@orange.com ITU Workshop on “Cloud Computing Standards – Today and the Future” (Geneva, Switzerland 14 November 2014)

2. Geneva, Switzerland, 14 November 2014 2 Agenda Introduction Scope of 27018 Methodology Context Requirements Structure Principles Sector-specific examples Conclusion

3. Geneva, Switzerland, 14 November 2014 3 ISO/IEC 27018 Title Code of practice for PII protection in public clouds acting as PII processors PII=Personally Identifiable Information ISO/IEC JTC1 SC27 WG5 Information technology, Security techniques, Identity management and privacy technologies published in 2014/08

4. Geneva, Switzerland, 14 November 2014 4 SC 27 Figure by Jan Schallaböck, Vice-Convenor WG5

5. Geneva, Switzerland, 14 November 2014 5 WG5 Figure by Jan Schallaböck, Vice-Convenor WG5

6. Geneva, Switzerland, 14 November 2014 6 Scope Objective To create a common set of security categories and controls that apply to a public cloud computing service provider To meet the requirements for the protection of PII

7. Geneva, Switzerland, 14 November 2014 7 Methodology Collecting together PII protection requirements according to ISO/IEC 29100 and the guidance for implementing controls given in ISO/IEC 27002 Designed for All types and sizes of organizations

8. Geneva, Switzerland, 14 November 2014 8 Context A public cloud service provider is a “PII processor” when it processes PII for and according to the instructions of a cloud service customer (controller) “Privacy by Design” “PII lyfecycle consideration” Information security risk environment

9. Geneva, Switzerland, 14 November 2014 9 Ecosystem Figure by Chris Mitchell, 27018 Editor

10. Geneva, Switzerland, 14 November 2014 10 Requirements Three main sources legal, statutory, regulatory and contractual requirements risks corporate policies

11. Geneva, Switzerland, 14 November 2014 11 27002 structure Security policies Organization of information security Human resource security Asset management Access control Cryptography Physical and environmental security Operations security Communications security System acquisition, development and maintenance Supplier relationships Information security incident management Information security aspects of business continuity management Compliance

12. Geneva, Switzerland, 14 November 2014 12 29100 principles Consent and choice Purpose legitimacy and specification Collection limitation Data minimization Use, retention and disclosure limitation Accuracy and quality Openness, transparency and notice Individual participation and access Accountability Information security Privacy compliance

13. Geneva, Switzerland, 14 November 2014 13 sector-specific examples clearly allocate responsibilities between the public cloud PII processor, its sub-contractors and the cloud service customer facilitate the exercise of PII principals’ rights ensure purpose specification and limitation principles notify data breach specify PII geographical location

14. Geneva, Switzerland, 14 November 2014 14 Conclusion comply with applicable obligations be transparent enter into contractual agreement demonstrate effective implementation of PII protection do not replace applicable legislation and regulations, but can assist complete with standards in progress (29151, 29134…)