Security Lights the Way

Crossbearing · standards comparison

ISO/IEC 27701 to ISO/IEC 27001

What you can reuse, what to extend and what is new when you add ISO/IEC 27001 to ISO/IEC 27701.

Compare another pair

What carries over from ISO/IEC 27701 to ISO/IEC 27001

Your PIMS gives you the management system and the security controls for PII. ISO/IEC 27001 widens them from PII processing to all the information in its scope, with a Statement of Applicability against its 93 controls.

Of the 118 clauses and controls ISO/IEC 27001 asks for: 10 to reuse, 45 to extend and 63 new.

  • 10 Reuse Use what you have: the same process or document, with its scope widened.
  • 45 Extend Keep what you have and add the new standard’s content.
  • 63 New Nothing you have covers it: new work.

Clause and control numbers checked against ISO/IEC 27701 and ISO/IEC 27001 themselves; descriptions are MajorCyber™’s own words. Mapping by MajorCyber™, last checked 23 October 2026. Going the other way? ISO/IEC 27001 to ISO/IEC 27701

Do I need to rewrite my policies?

No. Keep your privacy policy. Widen the security policies your PIMS already has for PII processing to all information, and add the topic-specific security policies your risks call for.

The management system, clause by clause

Both follow the harmonised structure that ISO management-system standards share, so clauses 4 to 10 line up by number. Each row says what ISO/IEC 27001 asks for and what to do with what your PIMS already has.

Clause Your ISO/IEC 27701 ISO/IEC 27001 asks for What to do
4.1 Context Issues that affect the PIMS, including whether climate change is relevant, and whether the organisation acts as a PII controller (alone or jointly), a PII processor or both. Internal and external issues that affect what the ISMS is meant to achieve — including, since the 2024 amendment, whether climate change is relevant. Extend Add the information security issues to the context you already analyse.
4.2 Interested parties Who has a stake in the organisation’s handling of PII — the people it relates to, customers, regulators, processors — and what they require. Who has a stake in information security, what they require, and which of those requirements the ISMS will address. Extend Keep what your PIMS has here, and add what ISO/IEC 27001 asks for.
4.3 Scope The boundaries of the PIMS: which processing, systems and roles it covers. The boundaries of the ISMS: which parts of the organisation, locations, assets and interfaces it covers. Extend Write the ISMS scope; it usually covers more than the systems that process PII.
4.4 The management system A PIMS that is set up, run, maintained and continually improved, with its processes and how they interact. An ISMS that is set up, run, maintained and continually improved, with its processes and how they interact. Reuse Use your PIMS’s process for both systems, with its scope widened to the ISMS.
5.1 Leadership Top management directs and supports the PIMS: aligned with strategy, built into the business, resourced and communicated. Top management directs and supports the ISMS: aligned with strategy, built into the business, resourced and communicated. Extend Keep what your PIMS has here, and add what ISO/IEC 27001 asks for.
5.2 Policy A privacy policy from top management that frames privacy objectives and commits to meeting requirements and improving. An information security policy from top management that frames objectives and commits to meeting requirements and improving. New An information security policy, beside the privacy policy or as a clearly marked part of an integrated one.
5.3 Roles Responsibilities and authorities for privacy assigned and communicated. Responsibilities and authorities for information security assigned and communicated. Extend Add information security roles to those you already assign.
6.1.1 Risks and opportunities Plan how the PIMS addresses its risks and opportunities. Plan how the ISMS addresses the risks and opportunities that come from its context and interested parties. Extend Keep what your PIMS has here, and add what ISO/IEC 27001 asks for.
6.1.2 Risk assessment A repeatable privacy risk assessment of the privacy and information security risks in scope, weighing the consequences for the people whose PII it is as well as for the organisation, with risk owners. A repeatable information security risk assessment: criteria for acceptance and assessment, risk owners, likelihood and consequence, prioritisation. Extend Keep one risk method, and widen it to the security risks to all the information in scope.
6.1.3 Risk treatment Choose treatments and controls, identify and document the information security programme you run (6.1.3 c), check against Annex A, and write a Statement of Applicability (6.1.3 e) and a treatment plan approved by the privacy risk owners. Choose treatments and the controls they need, compare them with Annex A, write a Statement of Applicability (6.1.3 d) and a treatment plan approved by the risk owners. Extend Keep one treatment process, but write a separate Statement of Applicability against the 93 controls of ISO/IEC 27001 Annex A.
6.2 Objectives Privacy objectives, with plans for who achieves them, how and by when. Measurable information security objectives, with plans for who achieves them, how and by when. Extend Keep what your PIMS has here, and add what ISO/IEC 27001 asks for.
6.3 Planning changes Changes to the management system are carried out in a planned way. Changes to the management system are carried out in a planned way. Reuse Use your PIMS’s process for both systems, with its scope widened to the ISMS.
7.1 Resources The resources the management system needs are provided. The resources the management system needs are provided. Reuse Use your PIMS’s process for both systems, with its scope widened to the ISMS.
7.2 Competence People whose work affects privacy are competent, with evidence kept. People whose work affects information security are competent, with evidence kept. Extend Add security competences to the framework and its records.
7.3 Awareness People know the privacy policy and their part in the PIMS. People know the security policy, their part in the ISMS, and what failing to follow it means. Extend Keep what your PIMS has here, and add what ISO/IEC 27001 asks for.
7.4 Communication What is communicated, when, to whom and how. What is communicated, when, to whom and how. Reuse Use your PIMS’s process for both systems, with its scope widened to the ISMS.
7.5 Documented information Documents and records the PIMS needs are created, updated and controlled. Documents and records the ISMS needs are created, updated and controlled. Reuse Use your PIMS’s process for both systems, with its scope widened to the ISMS.
8.1 Operational control Processes planned, run and controlled, including outsourced ones, with evidence that they ran as planned. Processes planned, run and controlled, including outsourced ones, with evidence that they ran as planned. Extend Keep what your PIMS has here, and add what ISO/IEC 27001 asks for.
8.2 Risk assessment in operation Privacy risk assessments carried out at planned intervals and when significant changes happen. Risk assessments carried out at planned intervals and when significant changes happen. Extend Keep what your PIMS has here, and add what ISO/IEC 27001 asks for.
8.3 Risk treatment in operation The privacy risk treatment plan implemented. The risk treatment plan implemented. Extend Keep what your PIMS has here, and add what ISO/IEC 27001 asks for.
9.1 Monitoring and measurement What is monitored and measured, how and when, and how the results are evaluated. What is monitored and measured, how and when, and how the results are evaluated. Extend Keep what your PIMS has here, and add what ISO/IEC 27001 asks for.
9.2 Internal audit Internal audits at planned intervals, by objective auditors, against the standard and the organisation’s own requirements. Internal audits at planned intervals, by objective auditors, against the standard and the organisation’s own requirements. Reuse Keep one audit procedure; widen the programme to the ISMS and its controls.
9.3 Management review Top management reviews the PIMS at planned intervals, with set inputs and recorded decisions. Top management reviews the ISMS at planned intervals, with set inputs and recorded decisions. Reuse Use your PIMS’s process for both systems, with its scope widened to the ISMS.
10.1 Continual improvement The PIMS keeps getting more suitable, adequate and effective. The ISMS keeps getting more suitable, adequate and effective. Reuse Use your PIMS’s process for both systems, with its scope widened to the ISMS.
10.2 Nonconformity and corrective action Nonconformities are corrected, their causes found and removed, and the actions checked. Nonconformities are corrected, their causes found and removed, and the actions checked. Reuse Use your PIMS’s process for both systems, with its scope widened to the ISMS.

Controls: ISO/IEC 27001 Annex A, against ISO/IEC 27701 Annex A

Table A.3 of ISO/IEC 27701 gives you 29 of the 93 ISO/IEC 27001 controls, for PII processing; widen them to all information. The rest are new.

ISO/IEC 27001 control Supported by your ISO/IEC 27701 What to do
Organisational
5.1 Security policy set, approved and kept under review
  • A.3.3 Security policies covering PII processing Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.2 Security roles and responsibilities assigned
  • A.3.4 Security roles for PII processing Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.3 Conflicting duties kept apart No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.4 Managers require staff to follow security policy No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.5 Contacts with the relevant authorities
  • A.2.5.5 Customers told of legally binding disclosure requests Related
New Handling disclosure requests helps; keep contacts with the relevant authorities.
5.6 Links with security forums and specialist groups No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.7 Threat intelligence gathered and used No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.8 Security built into projects No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.9 Inventory of information and assets, with owners No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.10 Rules for acceptable use of information and assets No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.11 Assets handed back when people leave No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.12 Information classified by sensitivity
  • A.3.5 Classification that takes PII into account Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.13 Information labelled to match its classification
  • A.3.6 Labelling that takes PII into account Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.14 Rules for transferring information
  • A.3.7 Rules for transferring PII Partly covers it
  • A.1.4.10 Transmitted PII reaches only its destination Partly covers it
  • A.2.4.4 Transmitted PII reaches only its destination Partly covers it
  • A.1.5.2 Basis for transfers between jurisdictions Related
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.15 Access control rules No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.16 Identities managed through their life cycle
  • A.3.8 Identities managed through their life cycle Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.17 Passwords and other secrets managed No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.18 Access rights granted, reviewed and removed
  • A.3.9 Access rights to PII granted, reviewed and removed Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.19 Security in supplier relationships No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.20 Security terms in supplier contracts
  • A.3.10 Security terms in supplier agreements Partly covers it
  • A.1.2.7 Written contracts with PII processors Partly covers it
  • A.2.5.8 Subcontractors engaged only as the contract allows Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.21 Security across the ICT supply chain
  • A.2.5.7 Subcontractors disclosed before use Related
New Disclosing subcontractors helps; manage security across the whole ICT supply chain.
5.22 Supplier services monitored and reviewed
  • A.2.5.9 Customers told of subcontractor changes, with time to object Related
New Change notices help; monitor and review all supplier services.
5.23 Security for the cloud services you use No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.24 Incident management planned and prepared
  • A.3.11 Incident management planned for PII processing Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.25 Security events assessed and classified No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.26 Incidents responded to by procedure
  • A.3.12 Incidents responded to by procedure Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.27 Lessons from incidents applied No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.28 Evidence collected and preserved No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.29 Security kept up during disruption No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.30 ICT ready for business continuity No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.31 Legal, regulatory and contractual requirements identified
  • A.3.13 Legal and contractual security requirements for PII Partly covers it
  • A.1.3.2 Obligations to people identified and met Related
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.32 Intellectual property respected No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
5.33 Records protected
  • A.3.14 Records about PII protected Partly covers it
  • A.1.2.9 Records that support processing obligations Related
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.34 Privacy and personal data protected
  • A.1.2.3 Lawful basis identified and shown Covers it
  • A.1.2.2 Purposes identified and documented Related
Reuse Your controller controls more than cover this control for PII.
5.35 Independent review of security
  • A.3.15 Independent review of PII security Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.36 Compliance with security policies checked
  • A.3.16 Compliance with security policies checked Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
5.37 Operating procedures documented No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
People
6.1 Background checks before people join No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
6.2 Security duties in terms of employment No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
6.3 Security awareness, education and training
  • A.3.17 Awareness and training on PII security Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
6.4 Disciplinary process for policy breaches No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
6.5 Duties that continue after people leave or move No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
6.6 Confidentiality agreements
  • A.3.18 Confidentiality agreements Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
6.7 Remote working secured No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
6.8 Staff report security events No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
Physical
7.1 Secure perimeters No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
7.2 Entry controls No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
7.3 Offices, rooms and facilities secured No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
7.4 Premises monitored No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
7.5 Protection from physical and environmental threats No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
7.6 Rules for working in secure areas No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
7.7 Clear desks and locked screens
  • A.3.19 Clear desks and locked screens Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
7.8 Equipment sited and protected No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
7.9 Assets protected off site No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
7.10 Storage media handled securely
  • A.3.20 Storage media holding PII managed Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
7.11 Power and other utilities protected No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
7.12 Cabling protected No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
7.13 Equipment maintained No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
7.14 Equipment wiped before disposal or reuse
  • A.3.21 Equipment wiped before disposal or reuse Partly covers it
  • A.2.4.3 PII returned, transferred or disposed of securely Related
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
Technological
8.1 User devices protected
  • A.3.22 User devices protected Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
8.2 Privileged access restricted No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.3 Access to information restricted No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.4 Access to source code controlled No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.5 Secure authentication
  • A.3.23 Secure authentication Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
8.6 Capacity managed No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.7 Malware protection No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.8 Technical vulnerabilities managed No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.9 Configurations managed No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.10 Information deleted when no longer needed
  • A.1.4.6 De-identified or deleted when no longer needed Partly covers it
  • A.1.4.9 Disposal policies and procedures Partly covers it
Extend De-identifying or deleting PII carries over; delete any information once it is no longer needed.
8.11 Data masking
  • A.1.4.5 Minimisation objectives and how they are met Related
New De-identification of PII is masking; apply masking by policy wherever data is sensitive.
8.12 Data leakage prevented No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.13 Backups
  • A.3.24 Backups, tested Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
8.14 Redundancy for availability No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.15 Logging
  • A.3.25 Logging, protected and analysed Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
8.16 Monitoring for anomalous behaviour No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.17 Clocks synchronised No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.18 Powerful utility programs restricted No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.19 Software installation on live systems controlled No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.20 Networks secured No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.21 Network services secured No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.22 Networks segregated No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.23 Web filtering No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.24 Cryptography and key management
  • A.3.26 Cryptography and key management Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
8.25 Secure development life cycle
  • A.3.27 Secure development life cycle Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
8.26 Security requirements for applications
  • A.3.28 Security requirements for applications Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
8.27 Secure architecture and engineering principles
  • A.3.29 Secure architecture and engineering principles Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
8.28 Secure coding No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.29 Security testing before release No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.30 Outsourced development overseen
  • A.3.30 Outsourced development overseen Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
8.31 Development, test and live environments kept apart No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.32 Changes controlled No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.
8.33 Test data protected
  • A.3.31 Test data protected Partly covers it
Extend Your PIMS runs this control for PII processing; widen it to all the information in the ISMS scope.
8.34 Audit testing that protects live systems No counterpart New Nothing in ISO/IEC 27701 Annex A corresponds: new work.

What to do with each document

The documented information ISO/IEC 27001 requires, and what to do with yours. Tick each one off as you go: the ticks are kept in this browser only.

A route from ISO/IEC 27701 to ISO/IEC 27001

  1. Scope

    • Set the ISMS scope: usually wider than the processing of PII
    • Decide how it relates to the PIMS scope

  2. Gap assessment

    • Go through this page clause by clause
    • Check the 93 controls of ISO/IEC 27001 Annex A; 29 have a Table A.3 counterpart you already run

  3. Governance

    • An information security policy approved by top management
    • Security roles assigned
    • Measurable security objectives

  4. Risk

    • Widen the risk method to all information in scope
    • Treat the risks and write the Statement of Applicability against ISO/IEC 27001 Annex A

  5. Controls

    • Widen the Table A.3 controls from PII to all information
    • Add the organisational, people, physical and technological controls your risks need

  6. Run and check

    • Operate the ISMS and keep its records
    • An internal audit that covers the ISMS
    • A management review with the ISMS inputs

  7. Certification

    • Ask your certification body about auditing both together, and line up the audit cycles

Certification and audits

  • The certificates are separate: one for ISO/IEC 27701, one for ISO/IEC 27001, each against its own standard and scope.
  • Ask your certification body about auditing both together, and line up the audit cycles.

Common pitfalls

  • Assuming the PIMS security controls cover the ISMS: Table A.3 has 29 of the 93, scoped to PII.
  • Scoping the ISMS to PII systems only.
  • Forgetting the controls with no PII counterpart, such as threat intelligence, network security and business continuity.

ISO/IEC 27701 and ISO/IEC 27001 at a glance

ISO/IEC 27701 ISO/IEC 27001
What it is Certifiable standard Certifiable standard
How it applies Voluntary, often required by customers Voluntary, often required by customers
How you show it Certification by an accredited certification body Certification by an accredited certification body
Where International International
Covers Privacy, Information security, Audit & assurance Information security, Risk management, Audit & assurance
Issued or enforced by ISO and IEC (ISO/IEC JTC 1/SC 27) ISO and IEC (joint technical committee ISO/IEC JTC 1/SC 27)
Current edition or status ISO/IEC 27701:2025 (published October 2025) replaces the 2019 edition and is now a standalone management-system standard. ISO/IEC 27001:2022, amended by ISO/IEC 27001:2022/Amd 1:2024 (climate change considerations). The 2013 edition's certification transition has ended.

Next steps on MajorCyber™

Sources

An educational comparison, researched and drafted with AI assistance. A mapping shows where work you have already done supports a requirement; it never means the requirement is met. Your certification body decides what conforms. No standard’s text is reproduced: buy the standards from ISO or your national standards body.