ISO 27701 – Clause 5.6 – Operation

ISO 27701 Clause 5.6 Explained: Key Operational Requirements

ISO 27701 Clause 5.6 deals with the practice of controlling the processes, controls and procedures that are necessary to operate with a robust privacy protection plan and privacy information management system.

Operational planning covers a broad range of topics – from structured change management activities to privacy protection risk assessments and risk treatment plans that improve the security of PII within the boundaries of the organisation’s network.

What’s Covered in ISO 27701 Clause 5.6

ISO 27701 Clause 5.6 features three sub-clauses that rely on accompanying guidance within ISO 27001:

• ISO 27701 5.6.1 – Operational planning and control (References ISO 27001 Control 8.1)
• ISO 27701 5.6.2 – Information security risk assessment (References ISO 27001 Control 8.2)
• ISO 27701 5.6.3 – Information security risk treatment (References ISO 27001 Control 8.3)

ISO 27701 5.6 contains no other guidance points that specifically deal with the implementation of a PIMS – instead focusing its attention more broadly on organisational privacy protection – nor does it feature any adjoining GDPR articles.

ISO 27701 Clause 5.6.1 – Operational Planning and Control

References ISO 27001 Control 8.1

ISO 27701 Control 5.6.1 outlines ISOs broader approach to privacy protection planning. Organisations should ‘plan, implement and control’ and internal procedures or processes that are relevant towards privacy protection and the storage and processing of PII (see ISO 27001 6.1 & 6.2).

ISO also asks organisations to retain documented information that evidences adherence and change across organisational privacy protection controls, including any outsourced activities.

Planning also extends to change management. ISO requires organisations to manage any internal changes to minimise the risk to PII and evaluate any unintended consequences arising from purposeful or inadvertent changes.

Relevant ISO 27001 Controls

• 6.1 – Actions to address risks and opportunities
• 6.1.2 – Information security risk assessment
• 6.2 – Information security objectives and planning to achieve them

ISO 27701 Clause 5.6.2 – Information Security Risk Assessment

References ISO 27001 Control 8.2

Organisations need to carry out periodic privacy protection risk assessments at key stages of the operation – such as a major change, or immediately after a security incident.

As with all PII-related activities, organisations should thoroughly document any risk assessment to improve its overall information security operation, and to be able to provide sufficient evidence to legal and regulatory authorities should the need arise.

Relevant ISO 27001 Controls

• 6.1.2 – Information security risk assessment

ISO 27701 Clause 5.6.3 – Information Security Risk Treatment

References ISO 27001 Control 8.3

In addition to periodic risk assessments, organisations should also enact a privacy protection ‘risk treatment plan’, which should contain recommendations that reduce the likelihood and/or impact of any risks inherent with the storage and processing of PII.

Supporting Controls From ISO 27001 and GDPR

How ISMS.online Helps

With your PIMS instantly accessible to interested parties, it’s never been easier to monitor, report and audit against both ISO 27001 and ISO 27701 at the click of a button.

Find out how much time and money you’ll save on your journey to a combined ISO 27001 and 27701 certification using ISMS.online.

See it live with ISMS.online by booking a demo.