Compliance FrameworksInternational
ISO/IEC 27701
Privacy Information Management System extension to ISO 27001 - PII controllers and processors.
Privacy Information Management System extension to ISO 27001 - PII controllers and processors.
| Short name | ISO 27701 |
| Region | International |
| Country or scope | International |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers ISO 27701
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for ISO 27701.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 26: 4 written for ISO 27701 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ISO27701-6.5 Asset Management for PII Systems | The PIMS extends ISO 27002 asset management to PII processing: assets involved in processing PII, including software components, must be identified and inventoried (ISO/IEC 27701:2019, Cl. 6.5) | Scan |
ISO27701-6.9 Operations Security and Integrity | Operations security controls extended for PII processing require protecting systems against unauthorized modification and malware, which presupposes integrity verification of the deployed software components (ISO/IEC 27701:2019, Cl. 6.9) | Scan |
ISO27701-6.9-VULN Technical Vulnerability Management | The extended operations-security guidance includes managing technical vulnerabilities of systems processing PII, which requires knowing the exact version of each component in order to match it against published vulnerabilities (ISO/IEC 27701:2019, Cl. 6.9 technical vulnerability management guidance) | Scan |
ISO27701-6.12 Supplier Relationships | Supplier relationship controls extended for privacy require addressing PII protection in agreements with suppliers, which depends on knowing the supplier of each component in the processing chain (ISO/IEC 27701:2019, Cl. 6.12) | Scan |
ISO27701-7.2.8 Records Related to Processing PII | PII controllers must determine and securely maintain the necessary records demonstrating processing of PII, which for technical systems means formally identified, timestamped machine-readable documentation (ISO/IEC 27701:2019, Cl. 7.2.8) | Scan |
ISO27701-6.15 Compliance Including Intellectual Property | The extended compliance controls cover identification of applicable legal requirements including intellectual property rights in the software used for PII processing, requiring license information for the components in use (ISO/IEC 27701:2019, Cl. 6.15) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
27701-5 | PIMS Requirements: Context and Leadership |
27701-6 | PIMS Planning: Privacy Risk Assessment |
27701-A.7.2.1 | Identify and Document PII Processing Purpose |
27701-A.7.2.2 | Identify Lawful Basis for PII Processing |
27701-A.7.3.1-10 | PII Principal Rights Fulfilment |
27701-A.7.4 | Privacy by Design and by Default |
27701-A.7.5 | International PII Transfers |
27701-B.8.2.1-B.8.5 | Processor Obligations (Annex B) |
27701-7-8 | PIMS Support: Competence, Awareness, Operational Control |
Policy templates
Written for ISO 27701:
- Privacy Information Management System (PIMS) Manual
- PII Processor Obligations Policy (Annex B)
- Privacy by Design and Default Procedure
- PII Principal Rights Fulfilment Procedure
And 22 from the standard set, adapted to ISO 27701.