ISO 27701 Implementation

We start the process by undertaking a detailed gap analysis of the organisation and its approach to controlled data protection measures.

The assessment is done aligned to the control requirements of the ISO 27701 standard.

Once the gaps are reviewed and documented the next step is to apply the required controls.

This is documented in a ‘statement of applicability’ which defines how the standard is going to apply to your organisation and sit alongside the controls for ISO 27001.

At this point, we have understood the gaps in compliance and we have documented and agreed the controls we need to implement.

The obvious next step is to develop a suitable plan for control implementation and the required change management and target operating model changes that will be required.

We would then adopt our ISO 27701 toolkit of documentation to fast track this key stage of the implementation.

Documentation would need to be fully aligned with the desired working practices and involves significant effort to review and refine as required.

Apart from documentation, the standard requires a significant change to many privacy operational processes and procedures.

The lead implementer is heavily involved at this stage in managing that change within the organisation.

Usually after a few months the organisation is ready for its internal audit.  This is then undertaken as it it was a certification audit and requires a total review of the implementation.

The audit findings are then produced and a report is issued with all observations and any non-conformities.

Once the internal audit has been completed successfully, the organisation is then ready for its external certification audit which is undertaken by an authorised third-party.

We are on hand to support our clients during this phase of the implementation including being in attendance during the actual certification audit itself.