ISO 27701:2019
PIMS-specific requirements related to ISO/IEC 27001, ISO 27701:2019

ISO 27701:2019 5.6.1: Operational planning and control

The operational planning and control requirements of ISO/IEC 27001 apply to the PIMS, so the processes that deliver privacy outcomes must be planned, implemented, controlled against criteria and evidenced, with changes controlled and outsourced processing controlled.

Maintained by Gerard Blokdyk

What else in your programme already covers this

This control maps to 47 controls across 26 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

SOC 2 · 6 controls

  • SOC2-A1.3 A1.3 Testing recovery plan procedures
  • SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10)
  • SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12)
  • SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure
  • SOC2-P4.2 P4.2 Retaining personal information
  • SOC2-PI1.4 PI1.4 Controls over output delivery

NIST SP 800-53 Rev 5 · 5 controls

PCI DSS 4.0 · 4 controls

  • 1.2.1 1.2.1 Ruleset configuration standards for NSCs
  • 12.1.1 12.1.1 Overall information security policy established and disseminated
  • 2.1.1 2.1.1 Requirement 2 policies and procedures governed
  • 6.5.1 6.5.1 Change control procedure for production
  • ISO-22313-8.1 Operational planning and control
  • ISO22313-8.1 Guidance on operational planning and control

ISO 30401 · 2 controls

  • ISO30401-06 Operational planning and control
  • ISO30401-8.1 Operational planning and control
  • ISO-39001-8.1 Operational planning and control
  • ISO39001-8.1 Operational Planning and Control
  • ISO-41001-8.1 Operational planning and control
  • ISO41001-8.1 Operational Planning and Control
  • ISO-50001-8.1 Operational planning and control
  • 8.1 Operational planning and control

ISO 56002 · 2 controls

  • ISO-56002-8.1 Operational planning and control
  • ISO56002-8.1 Operational planning and control

ISO/IEC 27003:2017 · 2 controls

  • 27003-8.1 Operational Planning and Control
  • ISO27003-8.1 Operational planning and control
  • NIST-CSF-ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated
  • NIST-CSF-ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked
  • AS9100D-8.1 Operational Planning and Control

GDPR · 1 control

ISO 14001:2015 · 1 control

  • 8.1 Operational planning and control

ISO 14004:2016 · 1 control

  • 8.1 Operational planning and control

ISO 22000:2018 · 1 control

  • 8.1 Operational planning and control

ISO 22301:2019 · 1 control

  • 8.1 Operational planning and control

ISO 27001:2022 · 1 control

  • 5.37 Documented operating procedures

ISO 27002:2022 · 1 control

  • 5.37 Documented operating procedures

ISO 37001:2016 · 1 control

  • 8.1 8.1 Operational planning and control

ISO 37301:2021 · 1 control

  • 8.1 Operational planning and control

ISO 45001:2018 · 1 control

  • 8.1 Operational planning and control

ISO 55001:2014 · 1 control

  • 8.1 Operational planning and control

ISO 9001:2015 · 1 control

  • 8.1 Operational planning and control

ISO/IEC 42001:2023 · 1 control

  • 8.1 Operational planning and control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in PIMS-specific requirements related to ISO/IEC 27001, ISO 27701:2019

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 5.6.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

Query this from an agent

The graph holds this control, the 47 it maps to, and the evidence behind each claim, over MCP and REST.