ISO/IEC 27036-4:2016为云服务客户和云服务提供商提供有关 a） 了解与使用云服务相关的信息安全风险，并有效管理这些风险，以及 b） 应对与获取或提供云服务相关的特定风险，这些风险可能会对使用这些服务的组织产生信息安全影响。 ISO/IEC 27036-4:2016不包括与云服务相关的业务连续性管理/弹性问题。ISO/IEC 27031解决了业务连续性问题。 ISO/IEC 27036-4:2016未提供云服务提供商应如何实施、管理和操作信息安全的指导。这些指南可在ISO/IEC 27002和ISO/IEC 27017中找到。 ISO/IEC 27036的范围- 4: 2016年将为云服务的使用制定支持信息安全管理实施的指南。

ISO/IEC 27036-4:2016 provides cloud service customers and cloud service providers with guidance on a) gaining visibility into the information security risks associated with the use of cloud services and managing those risks effectively, and b) responding to risks specific to the acquisition or provision of cloud services that can have an information security impact on organizations using these services. ISO/IEC 27036-4:2016 does not include business continuity management/resiliency issues involved with the cloud service. ISO/IEC 27031 addresses business continuity. ISO/IEC 27036-4:2016 does not provide guidance on how a cloud service provider should implement, manage and operate information security. Guidance on those can be found in ISO/IEC 27002 and ISO/IEC 27017. The scope of ISO/IEC 27036-4:2016 is to define guidelines supporting the implementation of information security management for the use of cloud services.