ISO 27701 LA study plan

Define privacy, personal data, PII, controller, processor and data subject in your own words and write one-line distinctions between each pair

Map the structure of ISO/IEC 27701 (scope, normative references, terms, Annexes A-F) onto a one-page diagram showing how it extends ISO/IEC 27001 and 27002

Explain from memory how the PIMS-specific requirements (Clauses 5-8) relate to the ISMS clauses they extend

List the privacy principles (lawfulness, purpose limitation, minimisation, accuracy, storage limitation, integrity/confidentiality, accountability) and give one PIMS control example for each

Walk through Clause 5 (PIMS-specific requirements for controllers) and write the audit evidence you would ask for against at least 8 of its subclauses

Contrast Clause 6 (processor requirements) with Clause 5 and identify the extra obligations that exist only for processors

Summarise Annex A and Annex B control objectives and explain how they pair with controller/processor roles

Draft a 10-item evidence request list that would test conformity of a PIMS scope statement and privacy policy

Distinguish PII controller vs PII processor obligations under joint-controller and sub-processor arrangements

Explain audit principles (integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach) and apply each to one privacy-specific scenario

Differentiate first-, second- and third-party audits and classify five given scenarios correctly

Distinguish conformity vs compliance vs effectiveness and write an audit criterion set for each type

Draft an audit plan for a hypothetical 12-month-scope PIMS audit including objectives, criteria, scope, schedule, roles and sampling approach

Identify impartiality threats in a proposed audit team and propose mitigations

Select and justify sampling strategies for PII processing records, consent logs and third-party agreements

Draft opening-meeting talking points and a set of interview questions for a Data Protection Officer and an IT operations lead

Practise classifying findings as conformity, minor nonconformity, major nonconformity, observation or opportunity for improvement using 10 written scenarios

Construct an audit trail that links a criterion, the evidence gathered, the finding statement and the risk implication

Distinguish evidence of implementation from evidence of effectiveness for three Annex A controls

Write nonconformity statements that meet the criteria of clear condition, criterion reference and objective evidence, then self-critique them against a checklist

Design a corrective-action review approach that tests root cause and not just the fix

Draft the structure and required content of an audit report for an ISO/IEC 27701 audit, including a distribution and confidentiality statement

Plan a closing meeting agenda including how to handle disagreement over a finding

Explain the certification decision process and the distinction between the audit team's conclusion and the certification body's decision

Define the elements of an audit programme (objectives, risk, scheduling, resources, competence, monitoring, review) and apply them to a three-year certification cycle

Explain how audit programme risk assessment drives frequency and depth of PIMS audits

Identify competence criteria for ISO/IEC 27701 auditors and evaluate a fictional auditor CV against them

Re-test Domain 1 and 2 weak areas by re-answering missed practice questions and writing corrective notes

Describe the role of accreditation, surveillance audits and recertification in the programme lifecycle

Complete a full timed mock examination under exam conditions and score it by domain

Analyse every wrong answer and tag it to a root cause (knowledge gap, misread, terminology confusion)

Re-derive the key clause-to-Annex mapping without notes to confirm retention

Drill scenario-based questions on controller/processor classification until accuracy is consistently high

Close each of the five weakest topics from Week 7 with targeted re-study and a written summary card

Take a second timed mock exam and compare domain scores against Week 7

Rehearse the audit lifecycle end to end by narrating plan, conduct, report and close from memory in under 15 minutes

Finalise a one-page reference sheet of clause numbers, Annex structures and finding classifications