eLibrary >
ISO/IEC 27701:2019 Security techniques - Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management - Requirements and guidelines >
ISO/IEC 27701:2019 Security techniques - Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management - Requirements and guidelines, 2019
- Foreword
- Introduction
- 1 Scope
- 2 Normative references
- 3 Terms, definitions and abbreviations
- 4 General
- 4.1 Structure of this document
- 4.2 Application of ISO/IEC 27001:2013 requirements
- 4.3 Application of ISO/IEC 27002:2013 guidelines
- 4.4 Customer
- 5 PIMS-specific requirements related to ISO/IEC 27001
- 5.1 General
- 5.2 Context of the organization
- 5.2.1 Understanding the organization and its context
- 5.2.2 Understanding the needs and expectations of interested parties
- 5.2.3 Determining the scope of the information security management system
- 5.2.4 Information security management system
- 5.3 Leadership
- 5.3.1 Leadership and commitment
- 5.3.2 Policy
- 5.3.3 Organizational roles, responsibilities and authorities
- 5.4 Planning
- 5.4.1 Actions to address risks and opportunities
- 5.4.2 Information security objectives and planning to achieve them
- 5.5 Support
- 5.5.1 Resources
- 5.5.2 Competence
- 5.5.3 Awareness
- 5.5.4 Communication
- 5.5.5 Documented information
- 5.6 Operation
- 5.6.1 Operational planning and control
- 5.6.2 Information security risk assessment
- 5.6.3 Information security risk treatment
- 5.7 Performance evaluation
- 5.7.1 Monitoring, measurement, analysis and evaluation
- 5.7.2 Internal audit
- 5.7.3 Management review
- 5.8 Improvement
- 5.8.1 Nonconformity and corrective action
- 5.8.2 Continual improvement
- 6 PIMS-specific guidance related to ISO/IEC 27002
- 6.1 General
- 6.2 Information security policies
- 6.2.1 Management direction for information security
- 6.3 Organization of information security
- 6.3.1 Internal organization
- 6.3.2 Mobile devices and teleworking
- 6.4 Human resource security
- 6.4.1 Prior to employment
- 6.4.2 During employment
- 6.4.3 Termination and change of employment
- 6.5 Asset management
- 6.5.1 Responsibility for assets
- 6.5.2 Information classification
- 6.5.3 Media handling
- 6.6 Access control
- 6.6.1 Business requirements of access control
- 6.6.2 User access management
- 6.6.3 User responsibilities
- 6.6.4 System and application access control
- 6.7 Cryptography
- 6.7.1 Cryptographic controls
- 6.8 Physical and environmental security
- 6.8.1 Secure areas
- 6.8.2 Equipment
- 6.9 Operations security
- 6.9.1 Operational procedures and responsibilities
- 6.9.2 Protection from malware
- 6.9.3 Backup
- 6.9.4 Logging and monitoring
- 6.9.5 Control of operational software
- 6.9.6 Technical vulnerability management
- 6.9.7 Information systems audit considerations
- 6.10 Communications security
- 6.10.1 Network security management
- 6.10.2 Information transfer
- 6.11 Systems acquisition, development and maintenance
- 6.11.1 Security requirements of information systems
- 6.11.2 Security in development and support processes
- 6.11.3 Test data
- 6.12 Supplier relationships
- 6.12.1 Information security in supplier relationships
- 6.12.2 Supplier service delivery management
- 6.13 Information security incident management
- 6.13.1 Management of information security incidents and improvements
- 6.14 Information security aspects of business continuity management
- 6.14.1 Information security continuity
- 6.14.2 Redundancies
- 6.15 Compliance
- 6.15.1 Compliance with legal and contractual requirements
- 6.15.2 Information security reviews
- 7 Additional ISO/IEC 27002 guidance for PII controllers
- 7.1 General
- 7.2 Conditions for collection and processing
- 7.2.1 Identify and document purpose
- 7.2.2 Identify lawful basis
- 7.2.3 Determine when and how consent is to be obtained
- 7.2.4 Obtain and record consent
- 7.2.5 Privacy impact assessment
- 7.2.6 Contracts with PII processors
- 7.2.7 Joint PII controller
- 7.2.8 Records related to processing PII
- 7.3 Obligations to PII principals
- 7.3.1 Determining and fulfilling obligations to PII principals
- 7.3.2 Determining information for PII principals
- 7.3.3 Providing information to PII principals
- 7.3.4 Providing mechanism to modify or withdraw consent
- 7.3.5 Providing mechanism to object to PII processing
- 7.3.6 Access, correction and/or erasure
- 7.3.7 PII controllers' obligations to inform third parties
- 7.3.8 Providing copy of PII processed
- 7.3.9 Handling requests
- 7.3.10 Automated decision making
- 7.4 Privacy by design and privacy by default
- 7.4.1 Limit collection
- 7.4.2 Limit processing
- 7.4.3 Accuracy and quality
- 7.4.4 PII minimization objectives
- 7.4.5 PII de-identification and deletion at the end of processing
- 7.4.6 Temporary files
- 7.4.7 Retention
- 7.4.8 Disposal
- 7.4.9 PII transmission controls
- 7.5 PII sharing, transfer, and disclosure
- 7.5.1 Identify basis for PII transfer between jurisdictions
- 7.5.2 Countries and international organizations to which PII can be transferred
- 7.5.3 Records of transfer of PII
- 7.5.4 Records of PII disclosure to third parties
- 8 Additional ISO/IEC 27002 guidance for PII processors
- 8.1 General
- 8.2 Conditions for collection and processing
- 8.2.1 Customer agreement
- 8.2.2 Organization’s purposes
- 8.2.3 Marketing and advertising use
- 8.2.4 Infringing instruction
- 8.2.5 Customer obligations
- 8.2.6 Records related to processing PII
- 8.3 Obligations to PII principals
- 8.3.1 Obligations to PII principals
- 8.4 Privacy by design and privacy by default
- 8.4.1 Temporary files
- 8.4.2 Return, transfer or disposal of PII
- 8.4.3 PII transmission controls
- 8.5 PII sharing, transfer, and disclosure
- 8.5.1 Basis for PII transfer between jurisdictions
- 8.5.2 Countries and international organizations to which PII can be transferred
- 8.5.3 Records of PII disclosure to third parties
- 8.5.4 Notification of PII disclosure requests
- 8.5.5 Legally binding PII disclosures
- 8.5.6 Disclosure of subcontractors used to process PII
- 8.5.7 Engagement of a subcontractor to process PII
- 8.5.8 Change of subcontractor to process PII
- Annex A (normative) PIMS-specific reference control objectives and controls (PII Controllers)
- Annex B (normative) PIMS-specific reference control objectives and controls (PII Processors)
- Annex C (informative) Mapping to ISO/IEC 29100
- Annex D (informative) Mapping to the General Data Protection Regulation
- Annex E (informative) Mapping to ISO/IEC 27018 and ISO/IEC 29151
- Annex F (informative) How to apply ISO/IEC 27552 to ISO/IEC 27001 and ISO/IEC 27002
- Bibliography [Go to Page]