ISO 27701:2019
Additional ISO/IEC 27002 guidance for PII processors, ISO 27701:2019

ISO 27701:2019 8.4.3: PII transmission controls

The organization must subject personal data transmitted over a data transmission network to controls designed to ensure it reaches its intended destination, typically by ensuring only authorized individuals have access to transmission systems and by following processes, including retaining audit data, that ensure transmission without compromise to the correct recipients, with transmission requirements capable of inclusion in the contract with the customer and, where no contractual requirement exists, advice appropriately taken from the customer before transmitting.

What else in your programme already covers this

This control maps to 57 controls across 27 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 7 controls

CIS Controls v8 · 4 controls

  • CIS-12.6 Use of Secure Network Management and Communication Protocols
  • CIS-3.10 Encrypt Sensitive Data in Transit
  • CIS-3.12 Segment Data Processing and Storage Based on Sensitivity
  • CIS-3.13 Deploy a Data Loss Prevention Solution

PCI DSS 4.0 · 4 controls

  • 3.4.2 Technical controls prevent unauthorized PAN copy
  • 4.2.1 Strong cryptography and security protocols are implemented as follows to safeguard PAN during transmission over open, public networks: • Only trusted keys and certificates are accepted. • Certificates used to safeguard PAN during transmission
  • 4.2.2 PAN is secured with strong cryptography whenever it is sent via end-user messaging technologies
  • 9.4.3 Media sent outside facility secured

Azure Security Benchmark · 3 controls

  • ASBv3-NS-9 Connect on-premises or cloud network privately
  • DP-3 Encrypt sensitive data in transit
  • LT-4 Enable network logging for security investigation

FedRAMP High · 3 controls

  • AC-3 Access Enforcement
  • AU-12 Audit Record Generation
  • SC-8(1) Cryptographic Protection

FedRAMP Moderate · 3 controls

  • AC-3 Access Enforcement
  • AU-12 Audit Record Generation
  • SC-8(1) Cryptographic Protection

ISO 27001:2022 · 3 controls

  • 5.14 Information transfer
  • 8.12 Data leakage prevention
  • 8.24 Use of cryptography

C5 (Germany) · 2 controls

  • C5-COS-08 Policies for data transmission
  • C5-CRY-02 Encryption of data for transmission (transport encryption)

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

HIPAA Security Rule · 2 controls

ISO/IEC 27018:2019 · 2 controls

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-PR.AA-04 Identity assertions are protected, conveyed, and verified
  • NIST-CSF-PR.DS-02 The confidentiality, integrity, and availability of data-in-transit are protected

NIST SP 800-53 Rev 5 LOW · 2 controls

  • AC-3 Access Enforcement
  • AU-12 Audit Record Generation

NIST SP 800-53 Rev 5 MODERATE · 2 controls

  • AC-3 Access Enforcement
  • AU-12 Audit Record Generation

NIST SP 800-53 Revision 5.1 HIGH · 2 controls

  • AC-3 Access Enforcement
  • AU-12 Audit Record Generation

NIST SP 800-66 Rev 2 · 2 controls

SOC 2 · 2 controls

  • SOC2-C1.1 Confidential information is identified and protected during receipt, processing, storage
  • SOC2-CC6.7 Transmission of data is restricted to authorized users

AWS Well-Architected Security Pillar · 1 control

CMMC 2.0 · 1 control

GDPR · 1 control

ISO 22301:2019 · 1 control

  • 8.4.3 Warning and communication

ISO 27002:2022 · 1 control

  • 8.12 Data leakage prevention

ISO 27018 · 1 control

ISO 9001:2015 · 1 control

  • 8.4.3 Information for external providers

ISO/IEC 27701:2019 · 1 control

  • 7.4.9 PII transmission controls (Controller)

NIST SP 800-161 Rev 1 · 1 control

  • 161R1-SC-8 Transmission Confidentiality and Integrity

NIST SP 800-171 Rev 3 · 1 control

  • 03.13.08 Transmission Confidentiality and Integrity

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Additional ISO/IEC 27002 guidance for PII processors, ISO 27701:2019

You are reading one control. How much of ISO 27701:2019 have you already done?

ISO 27701:2019 8.4.3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.

If you hold SOC 253.7% covered · 50 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.147.2% covered · 57 gapsIf you hold NIST Cybersecurity Framework 2.047.2% covered · 57 gapsIf you hold ISO 27001:202243.5% covered · 61 gapsIf you hold Australia Consumer Data Right - Banking (CDR)35.2% covered · 70 gapsIf you hold C5 (Germany)34.3% covered · 71 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 57 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO 27701:2019 controls