Initiation of the PIMS implementation
Domain 2 tests how to launch a PIMS implementation: mandate, scope, context, roles, legal landscape, and gap analysis. Initiation is not control selection; it establishes the foundation so later planning and implementation are defensible.
Core rules
- Secure top-management commitment and a written mandate before committing resources.
- Define the organisation's context: external and internal issues, interested parties such as PII principals, customers, regulators, and employees, and legal, regulatory, and contractual obligations.
- Determine the PIMS scope and its interfaces with the ISMS scope. Scope must reflect actual PII processing, locations, systems, and entities.
- Identify whether the organisation acts as PII controller, PII processor, or both, because that determines whether Clause 7 and Annex A, Clause 8 and Annex B, or all apply.
- Appoint a PIMS lead and team; define roles for privacy, security, legal, HR, procurement, and business owners. A DPO may be required by law but is not automatically the PIMS lead.
- Perform a gap analysis against 27701 clauses and annexes, using existing 27001 evidence where valid.
- Produce a business case, project plan, resource plan, and communication approach.
Worked example
A SaaS provider with ISO/IEC 27001 processes customer data as a processor and its own employee data as a controller. Initiation identifies both roles: Clause 8 and Annex B, plus Clause 7 and Annex A, apply. Scope covers the SaaS platform, support, and HR. Gap analysis finds 27001 covers access control but not PII request handling, retention, or customer breach notification. The project mandate assigns owners and a budget.
Traps that cost marks
Starting with annex controls before scope and context; assuming a single role; overlooking legal requirements; excluding business units that process PII; and treating initiation as a documentation exercise.