PIMS-specific guidance related to ISO/IEC 27002, ISO 27701:2019
ISO 27701:2019 6.15.2: Information security reviews
Independent review of information security applies, and where the organization is a processor and individual customer audits are impractical or would increase risk, it should make available to customers, before and during a contract, independent evidence that security is implemented and operated to its policies and procedures, an independent audit normally being acceptable where it meets what the expected users will need and reports openly; technical compliance review must include methods of reviewing the tools and components involved in processing personal data, which can include ongoing monitoring that only permitted processing occurs and specific penetration or vulnerability testing such as motivated intruder testing of de-identified datasets.
This control maps to 58 controls across 25 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction
NIST-CSF-GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
NIST-CSF-ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established
You are reading one control. How much of ISO 27701:2019 have you already done?
ISO 27701:2019 6.15.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.