ISO 27701:2019
PIMS-specific guidance related to ISO/IEC 27002, ISO 27701:2019

ISO 27701:2019 6.3.1: Internal organization

The organization must designate a contact point for the customer on matters of processing and, where it is a controller, a contact point for the individuals whose information it processes, and must name one or more people to be accountable for an organization wide privacy governance programme who, where appropriate, are independent, report to an appropriate management level, are involved in all issues touching the processing of personal data, are expert in data protection law and practice, act as the contact for supervisory authorities, inform management and staff of their obligations, and advise on privacy impact assessments.

Maintained by Gerard Blokdyk

What else in your programme already covers this

This control maps to 36 controls across 18 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 6 controls

PCI DSS 4.0 · 6 controls

  • 12.1.1 12.1.1 Overall information security policy established and disseminated
  • 12.1.4 12.1.4 Executive ownership of information security formally assigned
  • 12.5.1 12.5.1 Inventory of in-scope system components
  • 12.5.3 12.5.3 Scope review after significant organisational change
  • 2.1.1 2.1.1 Requirement 2 policies and procedures governed
  • 9.2.3 9.2.3 Physical protection of network hardware and lines

ISO 27001:2022 · 4 controls

  • 5.2 Information security roles and responsibilities
  • 5.35 Independent review of information security
  • 5.36 Compliance with policies, rules and standards for information security
  • 5.4 Management responsibilities

NIST Cybersecurity Framework 2.0 · 4 controls

  • NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • NIST-CSF-GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties
  • NIST-CSF-GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
  • NIST-CSF-GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

APPI · 2 controls

  • APPI-A32 Matters Concerning Retained Personal Data to Be Made Accessible
  • APPI-A40 Processing of Complaints

CMMC 2.0 · 2 controls

Azure Security Benchmark · 1 control

  • GS-1 Align organization roles, responsibilities and accountabilities

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

FedRAMP High · 1 control

  • PS-9 Position Descriptions (PS-9)

FedRAMP Moderate · 1 control

  • PS-9 Position Descriptions (PS-9)

GDPR · 1 control

HIPAA Security Rule · 1 control

ISO 27017:2015 · 1 control

  • 6.1 Internal organization

ISO 27018:2019 · 1 control

  • 6.1 Internal organization

ISO/IEC 42001:2023 · 1 control

  • A.3 Internal organization

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-66 Rev 2 · 1 control

SOC 2 · 1 control

  • SOC2-CC1.3 CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in PIMS-specific guidance related to ISO/IEC 27002, ISO 27701:2019

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 6.3.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

If you hold SOC 253.7% covered · 50 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.147.2% covered · 57 gapsIf you hold NIST Cybersecurity Framework 2.047.2% covered · 57 gapsIf you hold ISO 27001:202243.5% covered · 61 gapsIf you hold Australia Consumer Data Right - Banking (CDR)35.2% covered · 70 gapsIf you hold C5 (Germany)34.3% covered · 71 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 36 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO 27701:2019 controls