ISO 27701:2019
PIMS-specific guidance related to ISO/IEC 27002, ISO 27701:2019

ISO 27701:2019 6.2.1: Management direction for information security

The organization must state, in separate privacy policies or by augmenting its information security policies, its support for and commitment to complying with applicable legislation and regulation on the protection of personally identifiable information and with the contractual terms agreed with partners, subcontractors and third parties, clearly allocating responsibilities between them; applicable legislation and regulation must be considered whenever those policies are developed or maintained.

Maintained by Gerard Blokdyk

What else in your programme already covers this

This control maps to 70 controls across 31 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 15 controls

PCI DSS 4.0 · 14 controls

  • 1.1.1 1.1.1 Requirement 1 policies and procedures governed
  • 11.1.1 11.1.1 Requirement 11 policies and procedures managed
  • 12.1.1 12.1.1 Overall information security policy established and disseminated
  • 12.1.2 12.1.2 Security policy reviewed annually and updated as needed
  • 12.2.1 12.2.1 Rules for acceptable use of end-user technology
  • 2.1.1 2.1.1 Requirement 2 policies and procedures governed
  • 4.1.1 4.1.1 Requirement 4 policies and procedures maintained and communicated
  • 5.1.1 5.1.1 Requirement 5 policies and procedures maintained and communicated
  • 6.1.1 6.1.1 Requirement 6 policies and procedures maintained and communicated
  • 7.1.1 7.1.1 Requirement 7 policies and procedures maintained
  • 8.3.8 8.3.8 Authentication policies communicated to users
  • 9.1.1 9.1.1 Requirement 9 policies and procedures maintained
  • 3.1.1 3.1.1 Requirement 3 policies and procedures maintained and in use
  • 8.1.1 8.1.1 Requirement 8 policies and procedures maintained

NIST Cybersecurity Framework 2.0 · 5 controls

  • NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission
  • NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
  • NIST-CSF-GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
  • NIST-CSF-GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

ISO 27002:2022 · 3 controls

  • 5.1 Policies for information security
  • 5.10 Acceptable use of information and other associated assets
  • 5.4 Management responsibilities

SOC 2 · 3 controls

  • SOC2-CC1.2 CC1.2 Board independence and oversight of internal control (COSO principle 2)
  • SOC2-CC1.3 CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)
  • SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12)

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

  • CCM-DSP-01 Security and Privacy Policy and Procedures
  • CCM-GRC-01 Governance Program Policy and Procedures

ISO 19011:2018 · 2 controls

  • 5.5.7 Managing and maintaining audit programme records
  • 6.4.6 Reviewing documented information while conducting audit

ISO 27001:2022 · 2 controls

  • 5.1 Policies for information security
  • 5.4 Management responsibilities

NIST SP 800-161 Rev 1 · 2 controls

AWS Well-Architected Security Pillar · 1 control

  • SEC01-BP03 Identify and validate control objectives

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-STEP1 Step 1 - Define and implement security governance for CDR data

Australian Privacy Principles (APPs) · 1 control

  • APP-1 APP 1 - Open and transparent management of personal information

Azure Security Benchmark · 1 control

  • ASBv3-GS-3 Define and implement data protection strategy

C5 (Germany) · 1 control

CIS Controls v8 · 1 control

  • CIS-15.2 Establish and Maintain a Service Provider Management Policy

CMMC 2.0 · 1 control

FedRAMP High · 1 control

  • PL-1 Policy and Procedures

FedRAMP Moderate · 1 control

  • PL-1 Policy and Procedures

GDPR · 1 control

HIPAA Security Rule · 1 control

ISO 14001:2015 · 1 control

  • 6.2.1 Environmental objectives

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM) · 1 control

  • ISO-19650-5-7 Security management of information

ISO 27017:2015 · 1 control

  • 5.1 Management direction for information security

ISO 27018:2019 · 1 control

  • 5.1 Management direction for information security

ISO 45001:2018 · 1 control

ISO/IEC 20000-1:2018 · 1 control

  • 8.7.3 Information Security Management

ISO/IEC 27010:2015 · 1 control

  • 27010-5.1 Management Direction

ITIL 4 · 1 control

  • GM-ISM-1 Information Security Management

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-66 Rev 2 · 1 control

UK Gambling Commission LCCP and Remote Technical Standards · 1 control

  • UKGAMBLE-2 Information Security Management

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in PIMS-specific guidance related to ISO/IEC 27002, ISO 27701:2019

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 6.2.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

If you hold SOC 253.7% covered · 50 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.147.2% covered · 57 gapsIf you hold NIST Cybersecurity Framework 2.047.2% covered · 57 gapsIf you hold ISO 27001:202243.5% covered · 61 gapsIf you hold Australia Consumer Data Right - Banking (CDR)35.2% covered · 70 gapsIf you hold C5 (Germany)34.3% covered · 71 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 70 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO 27701:2019 controls