ISO 27701:2019
PIMS-specific requirements related to ISO/IEC 27001, ISO 27701:2019

ISO 27701:2019 5.8.2: Continual improvement

The continual improvement requirement of ISO/IEC 27001 applies to the PIMS, so the organization must keep improving the suitability, adequacy and effectiveness of the privacy extension and not only correct it when it fails.

Maintained by Gerard Blokdyk

What else in your programme already covers this

This control maps to 61 controls across 39 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

  • NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
  • NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
  • NIST-CSF-ID.IM-01 Improvements are identified from evaluations
  • NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
  • NIST-CSF-ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities

ISO 27002:2022 · 4 controls

  • 5.27 Learning from information security incidents
  • 5.35 Independent review of information security
  • 5.36 Compliance with policies, rules and standards for information security
  • 8.32 Change management

NIST SP 800-53 Rev 5 · 4 controls

PCI DSS 4.0 · 4 controls

  • 11.3.1 11.3.1 Quarterly internal vulnerability scans
  • 11.4.4 11.4.4 Correct exploitable findings from penetration tests
  • 12.1.2 12.1.2 Security policy reviewed annually and updated as needed
  • 12.10.6 12.10.6 Plan evolved from lessons learned and industry developments

SOC 2 · 4 controls

  • SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)
  • SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
  • SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
  • SOC2-P6.3 P6.3 Record of unauthorised disclosures and breaches
  • ISO-37002-10.2 Continual improvement
  • ISO37002-10.1 Continual Improvement
  • ISO-39001-10.2 Continual improvement
  • ISO39001-10.2 Continual Improvement
  • ISO-41001-10.2 Continual improvement
  • ISO41001-10.2 Continual Improvement
  • ISO-50001-10.2 Continual improvement
  • 10.2 Continual improvement

ISO 56002 · 2 controls

  • ISO-56002-10.3 Continual improvement
  • ISO56002-10.2 Continual improvement

ISO/IEC 27003:2017 · 2 controls

  • 27003-10.2 Continual Improvement
  • ISO27003-10.1 Nonconformity and corrective action
  • AS9100D-10.3 Continual Improvement
  • SPC1-A.1 Continual Improvement
  • BS65000-10.1 Continual Improvement

FedRAMP High · 1 control

  • CA-7 Continuous Monitoring

FedRAMP Moderate · 1 control

  • CA-7 Continuous Monitoring

ISO 10006:2003 · 1 control

  • 8.3 Continual improvement

ISO 14001:2015 · 1 control

  • 10.3 Continual improvement

ISO 14004:2016 · 1 control

  • 10.3 Continual improvement

ISO 19011:2018 · 1 control

  • 6.4.10 Conducting closing meeting

ISO 22000:2018 · 1 control

  • 10.2 Continual improvement

ISO 22301:2019 · 1 control

  • 10.1 Nonconformity and corrective action
  • ISO-22313-10.2 Continual improvement

ISO 22320:2018 · 1 control

  • ISO-22320-4.8 Continual improvement

ISO 27001:2022 · 1 control

  • 5.35 Independent review of information security

ISO 27005:2022 · 1 control

  • 10.8 Continual improvement

ISO 30401 · 1 control

  • ISO30401-10.2 Continual improvement

ISO 31000:2018 · 1 control

  • 4.h Continual improvement

ISO 37001:2016 · 1 control

  • 10.2 10.2 Continual improvement

ISO 37301:2021 · 1 control

  • 10.1 Continual improvement

ISO 45001:2018 · 1 control

  • 10.3 Continual improvement

ISO 55001:2014 · 1 control

  • 10.3 Continual improvement

ISO 9001:2015 · 1 control

  • 10.3 Continual improvement

ISO/IEC 23894:2023 · 1 control

  • ISO23894-4.8 Continual Improvement

ISO/IEC 27031:2011 · 1 control

  • 27031-10.1 Continual Improvement
  • ISO27557-10.1 Continual Improvement

ISO/IEC 42001:2023 · 1 control

  • 10.1 Continual improvement

ITIL 4 · 1 control

  • GM-CI-1 Continual Improvement

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in PIMS-specific requirements related to ISO/IEC 27001, ISO 27701:2019

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 5.8.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

Query this from an agent

The graph holds this control, the 61 it maps to, and the evidence behind each claim, over MCP and REST.