ISO/IEC 27017 and 27018 are not standalone certificates
They are cloud security and personal data controls, not standalone Type A management system standards, although they are frequently marketed as separate certificates.
03
On the software and data side, what decides is not the sector but which data you process, whether you provide a defined service to customers, and your role in the AI chain. For most technology companies several standards become candidates at once.
For organisations in any sector seeking to standardise processes and manage customer expectations systematically.
For organisations with substantial IT estates and for IT service providers.
For organisations that provide a defined IT service to others.
For organisations where service interruption is critical, or that are multi-site or critical suppliers.
For organisations that process data, access customer systems or provide cloud services.
For organisations processing personally identifiable information within an ISO 27001 scope.
For people-intensive organisations seeking corporate assurance over HR processes.
For organisations seeking to manage institutional knowledge systematically.
For organisations that develop, provide or use artificial intelligence in high-impact contexts.
For R&D and technology organisations establishing systematic innovation management.
For organisations providing application services using service robots.
They are cloud security and personal data controls, not standalone Type A management system standards, although they are frequently marketed as separate certificates.
An information security management system does not substitute for KVKK or GDPR compliance or legal advice. ISO/IEC 27701 strengthens this side but is still not a legal compliance certificate.
A team using a chat tool does not create ISO/IEC 42001 candidacy. The developer, provider or high-impact user role is questioned.
These are not ISO standards; each has its own scheme owner, issuing body and rules. Whether they are candidates is decided by activity and buyer requirement.
Last verified:
This page is for information only; it is not legal advice. A record appearing here does not mean it is required for your business. This library does not issue certificates.