PIMS-specific guidance related to ISO/IEC 27002, ISO 27701:2019
ISO 27701:2019 6.11.2: Security in development and support processes
System development and design policies must give guidance on the organization's processing needs based on its obligations to individuals and applicable law, covering privacy principles in the development lifecycle, privacy requirements at the design phase informed by risk or impact assessment, protection checkpoints at project milestones, the knowledge developers need, and minimising processing by default; systems and components processing personal data must be designed with privacy built in from the start and protective settings as the default so collection and processing are limited to what the identified purposes need and so that later obligations such as timely disposal are facilitated; change control, technical review, package change restrictions, secure development environments, outsourced development and system and acceptance testing apply as the base guidance requires.
This control maps to 74 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles
NIST-CSF-ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked
NIST-CSF-PR.PS-01 Configuration management practices are established and applied
NIST-CSF-PR.PS-02 Software is maintained, replaced, and removed commensurate with risk
NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle
You are reading one control. How much of ISO 27701:2019 have you already done?
ISO 27701:2019 6.11.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.