Sign in Discuss training
← All courses

Awareness · Information security

Cloud Security and Privacy (ISO/IEC 27017 & ISO/IEC 27018)

Help everyone understand who protects what in the cloud.

A practical introduction to ISO/IEC 27017:2026, guidance on information security controls for cloud services, and ISO/IEC 27018:2025, guidelines for protecting personal data in public clouds acting as processors. Both build on ISO/IEC 27002 and support an ISO/IEC 27001 management system.

Enrol now · US$19View a sample training video

Secure payment by Stripe · for yourself or for your team

Standard and editionISO/IEC 27017:2026 and ISO/IEC 27018:2025

Last updated3 October 2026

Preview this course

Experience the learning
before you enrol.

Watch a sample from Cloud Security and Privacy (ISO/IEC 27017 & ISO/IEC 27018) before you enrol.

Cloud Security and Privacy (ISO/IEC 27017 & ISO/IEC 27018)Sample

Learning outcomes

Knowledge you can put to work.

Connect the subject to the responsibilities and decisions people encounter in their roles.

  • Explain what ISO/IEC 27017 and ISO/IEC 27018 are and how they relate to ISO/IEC 27001 and ISO/IEC 27002
  • Describe how security responsibilities are shared between cloud service providers and cloud customers
  • Recognise the security risks that come with shared cloud services
  • Understand how personal data is protected when a public cloud provider processes it for customers
  • Describe your own part in using and protecting cloud services

Part of: Information Security and ISO 27001 Training

Inside the course

A clear path through the essentials.

13 modules, 13 practice checkpoints and a final exam. Video runtimes are approximate; allow additional time for the practice questions and the final exam.

Part 1Module 1Approx. 8 min
  1. Part 1 · Module 1 · Who protects what in the cloud8 min
  2. Practice: Part 1 · Module 1 · Who protects what in the cloud3 questions
Part 2Module 2Approx. 7 min
  1. Part 1 · Module 2 · Cloud in plain words7 min
  2. Practice: Part 1 · Module 2 · Cloud in plain words3 questions
Part 3Module 3Approx. 7 min
  1. Part 1 · Module 3 · How the standards fit together7 min
  2. Practice: Part 1 · Module 3 · How the standards fit together3 questions
Part 4Module 4Approx. 8 min
  1. Part 1 · Module 4 · Shared responsibility8 min
  2. Practice: Part 1 · Module 4 · Shared responsibility3 questions
Part 5Module 5Approx. 7 min
  1. Part 1 · Module 5 · Before you sign7 min
  2. Practice: Part 1 · Module 5 · Before you sign3 questions
Part 6Module 6Approx. 7 min
  1. Part 1 · Module 6 · Running the cloud day to day7 min
  2. Practice: Part 1 · Module 6 · Running the cloud day to day3 questions
Part 7Module 7Approx. 7 min
  1. Part 1 · Module 7 · Access, configuration, backup, keys7 min
  2. Practice: Part 1 · Module 7 · Access, configuration, backup, keys3 questions
Part 8Module 8Approx. 7 min
  1. Part 1 · Module 8 · Keeping tenants apart7 min
  2. Practice: Part 1 · Module 8 · Keeping tenants apart3 questions
Part 9Module 9Approx. 7 min
  1. Part 2 · Module 9 · PII in the public cloud7 min
  2. Practice: Part 2 · Module 9 · PII in the public cloud3 questions
Part 10Module 10Approx. 7 min
  1. Part 2 · Module 10 · Purpose, consent and rights7 min
  2. Practice: Part 2 · Module 10 · Purpose, consent and rights3 questions
Part 11Module 11Approx. 8 min
  1. Part 2 · Module 11 · Storing, moving and deleting PII8 min
  2. Practice: Part 2 · Module 11 · Storing, moving and deleting PII3 questions
Part 12Module 12Approx. 8 min
  1. Part 2 · Module 12 · Transparency, breaches, accountability8 min
  2. Practice: Part 2 · Module 12 · Transparency, breaches, accountability3 questions
Part 13Module 13Approx. 9 min
  1. Part 2 · Module 13 · Access, logs and your part9 min
  2. Practice: Part 2 · Module 13 · Access, logs and your part3 questions

Frequently asked questions

Your questions,
answered.

About Cloud Security and Privacy (ISO/IEC 27017 & ISO/IEC 27018), its certificate and enrolment.

Ask Sterling
Who is the Cloud Security and Privacy course for?

It is for employees, IT and cloud teams, and managers in organisations that provide cloud services or rely on them, including teams that handle personal data in the cloud. It helps everyone understand who is responsible for which security measures and how personal data is protected. No prior knowledge of ISO/IEC 27017 or ISO/IEC 27018 is needed, so it suits new starters as well as managers.

What does the Cloud Security and Privacy course cover?

It is in two parts. Part 1 covers ISO/IEC 27017:2026: why cloud security matters, how the guidance builds on ISO/IEC 27002, controls across public, private and hybrid cloud, and the shared responsibility between provider and customer. Part 2 covers ISO/IEC 27018:2025: protecting personal data when a public cloud provider processes it for customers, from collection and storage to transmission and deletion. It closes with each person's part.

How long does the Cloud Security and Privacy course take?

It is a set of short video modules, each followed by practice questions, and a final exam. The course page shows the number of modules and the approximate video runtime; allow additional time for the practice questions and the exam. With 12 months of access, you can complete it in one sitting or spread it over several sessions.

Do learners receive a certificate?

Yes. Learners who reach the 70% pass mark in the final exam receive a Sterling Academy Certificate of Completion for Cloud Security and Privacy (ISO/IEC 27017 & ISO/IEC 27018). Each certificate carries a unique number and a QR code, and anyone can check it online using the certificate number and the holder's surname. It is a training certificate for the individual learner.

Is the course online and self-paced?

Yes. Cloud Security and Privacy (ISO/IEC 27017 & ISO/IEC 27018) is a self-paced online course made of short video modules, in English with captions. You study at your own pace during 12 months of access, and practice questions after modules help you check your understanding before the final exam. If a point is unclear, questions are answered by a Sterling consultant.

Can we enrol a team, and how much does it cost?

Cloud Security and Privacy (ISO/IEC 27017 & ISO/IEC 27018) is US$19 per learner. Teams save 20% for 11 to 50 learners and 30% for 51 to 200 learners; 201 or more learners are priced on request. Client administrators can track their team's progress. Prices are in US dollars, excluding taxes, and Sterling confirms final pricing and enrolment.

Does this course make our organisation ISO 27017 or ISO 27018 certified?

No. The Certificate of Completion is a training certificate: it shows that one person completed Cloud Security and Privacy and reached the pass mark in its final exam. ISO/IEC 27017 and ISO/IEC 27018 are guidance documents that extend ISO/IEC 27002 and support ISO/IEC 27001; they are not standalone certification standards. Sterling does not certify organisations. An organisation is certified to ISO/IEC 27001 by an independent certification body after that body's own audit; ask that body how it covers the cloud guidance.

Assessment & completion

Complete the learning.
Keep a verifiable record.

Learners who complete the course and its final exam receive a numbered Sterling Academy Certificate of Completion with online QR verification.

This records course completion. It does not confer ISO certification or a professional auditor qualification.

Pass mark
70%
Prerequisites
None
Ask about course requirements

Your next step

Ready to put Cloud Security and Privacy (ISO/IEC 27017 & ISO/IEC 27018) into practice?

Expert and experienced consultants, 8,100+ client engagements in 60+ countries, from gap assessment to a system ready for its certification audit.

Talk to a Sterling consultant

Run it in Effivity

Effivity is our no-code ISO and GRC software: documents, risks, audits, nonconformities and corrective actions, objectives and training records in one place.

Start an Effivity trial

Not sure which course?

Plan your next step
in learning.

Discuss your learning needs