A cloud service provider's board wants to adopt a certifiable management system that sets information security objectives, assesses risk, selects controls and drives continual improvement of the security program. Which standard should it adopt?

ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system. It requires the organization to understand its context, set security objectives, perform risk assessment and risk treatment, select controls with reference to Annex A, produce a statement of applicability, monitor performance, conduct internal audits and management reviews, and improve. Accredited bodies certify organizations against it. ISO/IEC 27017 provides guidance on information security controls for cloud services, including additional cloud-specific controls; it is a code of practice that extends 27001 and 27002 rather than a standalone management system standard, and attestations against it are normally made alongside 27001 certification. ISO/IEC 20000-1 specifies requirements for a service management system; it addresses information security only as one element of service delivery and does not replace an ISMS. ITIL is a body of best-practice guidance for IT service management; individuals can obtain ITIL qualifications, but organizations are not certified against ITIL. Exam caveat: ISO/IEC 27018 similarly extends 27001 for protection of PII by public cloud processors. Operational check: confirm the scope of the ISMS covers the cloud services offered, that the statement of applicability addresses relevant cloud controls, and that the certificate is current and issued by an accredited body.