The standards around ISO 27001 that buyers meet: ISO/IEC 27002 control guidance, the 27000 family, cloud and privacy extensions (27017, 27018, 27701), governance guidance and the CSA STAR certification built on ISO 27001.
How ISO 27001 and ISO 27002 differ and fit together: certifiable requirements versus guidance that cannot be certified, Annex A drawn from ISO/IEC 27002, control attributes, sector extensions and how organizations use 27002 to implement controls.
A buyer's map of the ISO/IEC 27000 family: the one certifiable ISMS standard, the 2026 overview document, control, risk, audit and measurement guidance, and sector extensions for cloud, privacy, energy, telecom and health.
What ISO/IEC 27017:2026 adds for cloud services, who it applies to on the provider and customer side, how it is used with ISO 27001 certification and the A.5.23 cloud control, and how providers such as AWS show it.
What ISO/IEC 27018:2025 covers for public cloud providers acting as PII processors, how it relates to ISO 27001, ISO 27017 and ISO 27701, and what cloud customers can and cannot rely on from a provider's ISO 27018 claim.
How the 2025 edition of ISO/IEC 27701 changes privacy certification: a standalone management system standard for PII controllers and processors, how it aligns with an ISO 27001 ISMS, bundles with ISO 27018, and GDPR expectations.
How ISO/IEC 27014 guides boards and top management in governing information security alongside an ISO 27001 ISMS: evaluate, direct, monitor and communicate, its link to clause 5 leadership, its pending revision, and how NIST CSF 2.0 governance outcomes compare.
How CSA STAR Certification builds on ISO 27001 for cloud providers: combining the ISMS audit with the Cloud Controls Matrix, STAR levels and the public registry, validity, approved auditors, and the related STAR for AI path with ISO 42001.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.