Organisational leadership and management is a recurring theme throughout all of ISO’s various information security management system-related standards.
Policies and procedures are only effective if they are both acknowledged and uniformly adhered to. Senior management plays a key role in ensuring that PII and PIMS-related activities are given the level of respect and professionalism that is warranted by their role in minimising risk, and improving information security across the board.
Clause 5.3 deals directly with senior management’s role in establishing a PIMS that meets an organisation’s external obligations and PII requirements from the ground up, through three key operational areas:
To achieve this, ISO 27701-5.3 contains three sub-clauses that reference guidance from 27001:2013.
All of these clauses should be viewed through the prism of establishing and maintaining a PIMS, PII security and privacy protection, rather than broadly applied to information security as a concept.
ISO 27001:2013-5.1 contains 7 main guidance points that provide top management with help on demonstrating ‘leadership and commitment’ when drafting an information security policy relating to PII.
Throughout the process of establishing a PIMS, top management should:
Information policies are the bread and butter of an organisation’s wider privacy protection efforts.
Senior management uses protocols and procedures to not only improve information security risk management as a whole, but also as a tool to measure staff performance and demonstrate to legal and regulatory authorities that the organisation is fulfilling its obligations towards PII.
Information security policies relating to privacy protection, PII and PIMS should:
Once established, policies should be made readily available to all relevant staff as version-controlled documents, and be widely communicated throughout the organisation – either at the point of creation, or when any amendments are made that have the potential to impact PII security.
Throughout its family of information security standards, ISO makes continual reference to role-based activities, based on a person’s job type and assigned responsibilities.
ISO 27701-5.3.3 asks organisations to ensure that anyone who uses PII, interacts with a PIMS, or is responsible for privacy protection has a clearly defined role and understands precisely what they are responsible for Including that of senior management themselves).
Senior management should ensure that all PIMS and PII-related procedures conform to ISO 27001 standards, and delegate reporting responsibilities to staff members that dissect the performance of the organisation’s PIMS at regular intervals.
*Control 6.2 – Information security objectives and planning to achieve them (referenced within ISO 27701 Clause 5.3.2)
| ISO 27701 Clause Identifier | ISO 27701 Clause Name | ISO 27001 Requirement | Associated GDPR Articles |
|---|---|---|---|
| 5.3.1 | Leadership and Commitment | 5.1 – Leadership and Commitment for ISO 27001 | None |
| 5.3.2 | Policy | 5.2 – Information Security Policy for ISO 27001 | None |
| 5.3.3 | Organisational Roles, Responsibilities and Authorities | 5.3 – Organisational Roles, Responsibilities & Authorities for ISO 27001 | None |
With our preconfigured PIMS you can quickly and easily organise and manage customer, supplier and staff information to fully comply with ISO 27701.
We make data mapping a simple task. It’s easy to record and review it all, adding your organisation’s details to our pre-configured dynamic Records of Processing Activity tool.
You’ll need to show how well you manage Data Subject Rights Requests (DRR). Our secure DRR space keeps it all in one place, supporting it with automated reporting and insight.
We’ve created a built-in risk bank and a range of other practical tools that’ll help with every part of the risk assessment and management process.
Find out more by booking a demo.
It helps drive our behaviour in a positive way that works for us
& our culture.
We can’t think of any company whose service can hold a candle to ISMS.online.
