PIMS-specific requirements related to ISO/IEC 27001, ISO 27701:2019
ISO 27701:2019 5.7.1: Monitoring, measurement, analysis and evaluation
The monitoring, measurement, analysis and evaluation requirements of ISO/IEC 27001 apply to the PIMS, so the organization must determine what privacy performance is measured, by what valid method, when and by whom, and must evaluate the results.
This control maps to 72 controls across 35 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.AE-04 The estimated impact and scope of adverse events are understood
NIST-CSF-DE.CM-01 Networks and network services are monitored to find potentially adverse events
NIST-CSF-DE.CM-09 Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
NIST-CSF-ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated
NIST-CSF-ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established
NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use
NIST-CSF-RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved
You are reading one control. How much of ISO 27701:2019 have you already done?
ISO 27701:2019 5.7.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.