A public cloud provider that processes personally identifiable information on behalf of its customers wants to adopt an international code of practice that extends ISO/IEC 27002 controls specifically for protecting PII in that processor role. Which standard should it adopt?

ISO/IEC 27018 is the code of practice for protecting personally identifiable information in public clouds acting as PII processors. It builds on ISO/IEC 27002 by adding implementation guidance and an extended control set derived from privacy principles, covering topics such as using PII only on customer instructions, disclosure of subprocessors, notification of law enforcement requests where permitted, return and deletion of data and breach notification to the customer. That makes it the precise fit for a provider seeking a recognized privacy control set for its processor role. ISO/IEC 27017 also extends ISO/IEC 27002 for cloud services, but it addresses information security controls for cloud providers and customers generally, not PII protection. Generally Accepted Privacy Principles, developed by the AICPA and CICA, define privacy principles and criteria for organizations broadly; they are useful for privacy programs and assessments but are not an international standard that extends ISO/IEC 27002 for cloud processors. ISO/IEC 27036 addresses information security in supplier relationships, which is relevant to cloud procurement but not to PII processing controls. Exam caveat: ISO/IEC 27018 is commonly certified alongside ISO/IEC 27001, since it is not a standalone management system. Operational check: confirm the provider's certificate scope explicitly names ISO/IEC 27018 and the services covered.