Six Weeks to Stage 1 at a Logistics Group
Vantage Logistics holds an ISO/IEC 27001 certificate covering "freight-forwarding operations and shared services in Rotterdam, Manila and Houston". It has applied to add ISO/IEC 27701 to the same certificate, and the certification body has proposed stage 1 in six weeks followed by a combined stage 2. A consultant's pre-assessment found: the statement of applicability lists eight Annex A controls as "not applicable - Vantage does not rely on consent", although the driver mobile app asks for consent to location tracking; the internal audit covered Rotterdam only and sampled no PIMS records; the Manila service centre, which handles all data subject requests, was outside the sample; the last management review was in March, before the PIMS existed; the processing register is a shared-drive spreadsheet with no named owner and 43 of 210 entries have no lawful basis recorded; and the privacy policy exists only as a web page, never communicated internally. The COO wants to "just go for it" and fix findings after certification.
1. Should Vantage proceed with the stage 1 date? Separate what genuinely blocks stage 1 from what can wait until stage 2.
Read the worked answer
Proceed only if the blocking items can be genuinely completed in six weeks; do not plan to fix them after certification.
Blocking for stage 1, because stage 1 explicitly checks readiness - that the management system exists, that documented information is available, that internal audit and management review have been performed, and that the organisation understands the requirements:
- Management review must be held for the PIMS, with proper inputs and decisions. A March meeting predating the PIMS does not count.
- Internal audit must cover the PIMS scope and criteria. A Rotterdam-only, 27001-only audit leaves the PIMS unaudited, and Manila handles the highest-risk process.
- Statement of applicability must be coherent and justified. Eight blanket "not applicable" entries contradicted by the driver app will be challenged immediately.
- Scope and processing register ownership must be settled, since scope is the first thing stage 1 examines.
Can follow before stage 2: privacy policy internal communication and acknowledgement; completing lawful basis for all 210 register entries (though the highest-risk gaps should be closed first); evidence packs and sample preparation; deeper control evidence for the combined stage 2.
If the audit and management review cannot be completed properly within six weeks, request an extension of four to six weeks. A postponed stage 1 costs a diary slot; a failed stage 2 costs credibility with customers and the certificate timeline.
2. How will the certification body treat the 27701 audit as an extension to the existing 27001 certificate, and what does that mean for scope and audit effort?
Read the worked answer
ISO/IEC 27701 is an extension to ISO/IEC 27001, not a free-standing certification: the organisation must hold a 27001 certificate, and the PIMS scope must be consistent with and contained within the ISMS scope. The certificate normally states the privacy roles covered, for example PII controller and PII processor, because the applicable Annex controls depend on them.
Practical consequences for Vantage:
- One boundary. You cannot exclude Manila from the ISMS scope and include it in the PIMS scope, or the reverse. Any inconsistency is a scope finding.
- Additional criteria, shared evidence. The audit tests the PIMS-specific requirements and the applicable Annex controls in addition to the 27001 requirements. Evidence such as access control or supplier management may serve both, but privacy-specific evidence - consent records, request handling, retention deletion, DPIAs - must be sampled separately.
- Combined audit, separate decisions. Stage 1 and stage 2 can be combined across both standards, and surveillance can be aligned, but the certification decisions are recorded separately and the 27701 extension depends on the 27001 certificate remaining valid.
- Roles at the interface. Auditors spend time on the controller/processor boundary with customers: contracts, sub-processor lists, instructions and breach notification paths.
Plan audit time accordingly and brief the Manila team: the combined audit will follow the data subject request process end to end.
3. Are the eight "not applicable" entries for consent controls defensible, and what must Vantage do about them?
Read the worked answer
Not as written. The driver app collects consent for location tracking, so the statement "Vantage does not rely on consent" is factually wrong within the declared scope. An auditor will test this within minutes: open the app, find the consent screen, then ask why the corresponding control is excluded. That is a nonconformity and it undermines confidence in every other exclusion in the document.
What to do:
- Re-run the applicability analysis control by control, per role and per processing activity. Which processing relies on consent (driver location, optional marketing, app analytics)? Which relies on contract or legal obligation?
- Reinstate the consent-related controls as applicable, and evidence them: the consent screen text, versioning, records of consent and withdrawal, the effect of refusal on the service, and how consent is refreshed.
- For controls that genuinely do not apply, state why with a reference - contract clauses, register entries, architecture - and record the approver and review date.
- Check the consequence for the risk assessment: if consent was assumed absent, the associated risk may also have been missed.
- Consider whether customer controllers rely on Vantage to obtain consent on their behalf, which brings support obligations back in even where Vantage is a processor.
A corrected, reasoned SoA is achievable before stage 1 and is precisely the kind of readiness evidence the auditor is looking for.