ISO 27701 - 2019Privacy Information Management System (PIMS)
ISO 27701 - 2019
Overview
ISO 27701 provides specification and guidance for including personally identifiable information (PII) in the implementation of information security management system. It is referred as ‘Privacy information management system’. ISO 27701 extends the requirements of ISO/IEC 27001:2013 to take into account the protection of privacy of PII principals as potentially affected by the processing of PII, in addition to information security.
In Coral, we have a formal methodology to fulfill and implement ISO 27701/privacy information management system.
The standard requirements can be used by organizations to implement ISO 27701 as an independent assessment or an extension of an existing ISO 27001/ISO 27702 certification.
After we have identified whether an organization is a controller and/or a processor, we guide an organization through a step-by-step process of determining applicable requirements and taking them through the journey which has the following broad phases:
Our ISO 27701 - 2019 Consulting Methodology has the following broad phases
PHASE I Information flow assessment
This phase involves identification of information sources, and is processing infrastructure that involves personnel, technology, physical infrastructure.
PHASE II Gap Analysis
This phase involves performing privacy impact assessment and security risk assessment to determine security and legal loopholes. Identified gaps are provided with detail recommendations.
PHASE III Control Design and documentation
This phase involves our methodology that involves distribution security responsibility to internal stakeholders, with control policies and transactions that ensures that the PIMS is well embedded in the organization processes. This also includes nomination of a data protection officer and creating data protection office, for the organization. In a typical engagement organization receives 25+ policies and procedures.
PHASE IV Tracking
This phase involves tracking the client risks, and documentation on a weekly basis till all internal controls are adequately implemented.
PHASE VPerformance Tracking
This phase involves showcasing client with changes in a given period by providing change specific score of compliance between 0 -100% compliance.
PHASE VIInternal Audit
This phase involves verifying the governance system created for the organization is well in place and ready to declare as PIMS compliant.
