Preparing for a PIMS certification audit
Domain 7 tests how to prepare for a PIMS certification audit against ISO/IEC 27701 as an extension to ISO/IEC 27001.
Core rules
- Select an accredited certification body and agree the certification scope; scope must match the PIMS and ISMS scope and actual processing.
- Confirm audit criteria: ISO/IEC 27001 plus ISO/IEC 27701, including applicable Annex A/B/C controls.
- Complete internal audit and management review before Stage 1; close or manage nonconformities.
- Prepare evidence: scope, SoA, risk assessment and treatment, policies, records of processing, DPIAs, PII request logs, incident logs, supplier contracts, training records, and audit and review records.
- Stage 1 checks readiness and documentation; Stage 2 checks implementation and effectiveness. Auditors sample, interview, and trace evidence.
- Address findings; certification decision follows closure of nonconformities. Surveillance audits maintain certification.
Worked example
A processor about to be audited has a strong SoA but no PII request log. The gap is a Stage 2 risk because the control exists on paper but not in operation. It implements logging, runs a mini internal audit, and takes evidence to management review before Stage 1.
Traps that cost marks
Believing certification proves legal compliance; missing internal audit or management review; scope mismatch; treating Stage 1 as a formality; and having no operational evidence.