Nordwind: bolting a PIMS onto an existing 27001 certificate
Nordwind Logistics has held ISO/IEC 27001 certification since 2021. Its certification scope reads: 'Freight booking platform and supporting infrastructure operated from the Gdańsk headquarters and two data centres.' Customers now send privacy questionnaires, so the CISO wants 27701 added before the next surveillance audit. The consultant's plan has three parts: write a standalone PIMS manual; extend the scope to all 14 branch offices plus the HR function, because 'privacy touches everything'; and run a completely separate privacy risk assessment with its own methodology and risk register. The draft Statement of Applicability lists 93 controls from ISO/IEC 27001 Annex A and then adds 14 entries copied from ISO/IEC 27002 implementation guidance, described as 'additional privacy controls'. The auditor's pre-assessment notes that the same retention requirement appears in four rows with four different owners, and that paper HR files at the branches are described in the PIMS documents but excluded from the ISMS scope.
1. Explain how ISO/IEC 27701 relates to ISO/IEC 27001 and ISO/IEC 27002, and whether Nordwind can certify a PIMS on its own.
Read the worked answer
ISO/IEC 27701 is an extension to ISO/IEC 27001 and ISO/IEC 27002, not a free-standing management system standard. The PIMS is the ISMS plus privacy-specific requirements and guidance.
- Clause 5 adds PIMS-specific requirements on top of the management-system clauses of ISO/IEC 27001 (context, leadership, planning, support, operation, performance evaluation, improvement). Those extensions include identifying whether you act as PII controller, PII processor or both, and reflecting that in the management system.
- Clause 6 adds PIMS-specific guidance on top of ISO/IEC 27002.
- Annexes A and B are the normative control sets: A for PII controllers, B for PII processors. Annexes C and D are the corresponding guidance.
So there is no standalone 27701 certificate. Certification is against ISO/IEC 27001 with the ISO/IEC 27701 extension, which means an existing ISMS scope, risk assessment and Statement of Applicability must be extended rather than duplicated. ISO/IEC 27002 itself is guidance and is never certified against.
Practical consequence for Nordwind: one management system, one risk framework, one scope statement, one SoA covering both 27001 Annex A and the applicable 27701 Annex A or B controls. Confirm with the certification body which edition of 27701 and 27001 the surveillance audit will be conducted against, since the alignment between editions matters.
2. Identify what is wrong with the consultant's scope and Statement of Applicability, and explain the risk each defect creates.
Read the worked answer
Four defects, all audit-visible.
- A separate PIMS manual and a separate risk register break the 'extension' model. Privacy risks then never inform ISMS risk treatment and vice versa, and the 27701 requirement for a risk assessment covering PII processing sits in a document nobody in the security function reads.
- Guidance quoted as controls. Implementation guidance from ISO/IEC 27002 is not a control. Copying 14 guidance paragraphs into the SoA as 'additional privacy controls' produces duplicate, unowned entries and makes applicability impossible to justify. The SoA must list 27001 Annex A controls plus the applicable 27701 Annex A/B controls, each with a justification and a single owner.
- Four rows for one retention requirement with four owners. Nobody is accountable, and the retention rule cannot be evidenced. This is exactly the kind of finding that turns into a minor nonconformity against the records and retention controls on audit.
- Scope mismatch. Paper HR files described as in the PIMS but excluded from the ISMS scope means the certificate does not describe what is actually being managed. Either bring the branches and HR records inside a single, resourced scope, or exclude them explicitly with justification and accepted risk - and then remove them from the PIMS documentation and from marketing claims.
Scope creep to 14 branches plus HR also needs a resourcing and risk argument; a scope you cannot operate is worse than a narrow one you can.
3. You have one surveillance audit window. Give a remediation sequence with the reasoning for the order.
Read the worked answer
Order by dependency, not by effort.
- Decide the scope and get it signed by top management. Everything downstream is written against the scope. A 14-branch scope needs a resourcing decision, so this is a management call, not a documentation task.
- Determine roles per processing activity (controller, processor, both) because that selects Annex A versus Annex B controls - you cannot build the SoA before this.
- Merge the two risk methodologies into one framework with privacy criteria added (impact on individuals as well as on the organisation), then re-score existing entries rather than starting from zero.
- Gap-assess the applicable Annex A/B controls against what already exists. Many 27001 controls will carry over; the genuinely new ones are typically purpose documentation, lawful basis, PII principal requests, and processor agreements.
- Rebuild the SoA with one row per control, one owner, one justification - and delete the duplicated retention rows.
- Run the internal audit and management review on the rebuilt system before the external visit; a finding you raise yourself is cheaper than one the certification body raises.
The reasoning: steps 1-2 determine what evidence you need, steps 3-5 produce the evidence, and step 6 proves it operates. Doing documentation first is the classic failure mode - the manual gets rewritten twice.