ISO/IEC 27701: Structure, Scope and Relationship with ISO/IEC 27001 and ISO/IEC 27002
This domain tests how 27701 is built. Expect questions on the clause architecture, on which parts are auditable requirements versus guidance, and on how an existing ISMS is extended rather than replaced.
What the standard is
27701 is an extension to ISO/IEC 27001 and ISO/IEC 27002. The 2019 edition extends the 2013 editions of both; a second edition (ISO/IEC 27701:2025) realigns the text with ISO/IEC 27001:2022 and ISO/IEC 27002:2022 - confirm which edition your exam references. It is not standalone: an organisation cannot be certified to 27701 alone. The certificate reads ISO/IEC 27001 with the 27701 extension, and 27001 certification is a prerequisite.
Structure of the 2019 edition
- Clauses 4–10 mirror the management-system clauses of 27001, adding PIMS-specific requirements (Clause 5) and corresponding guidance (Clause 6).
- Clause 7 with Annex A - additional guidance and the normative controls for PII controllers.
- Clause 8 with Annex B - the same for PII processors.
- Annexes C–F - mappings to ISO/IEC 29100, to the GDPR, to ISO/IEC 27018 and 29151, and guidance on applying 27701 to 27001 and 27002.
Clauses 7 and 8 explain and interpret; Annexes A and B are the reference control set that goes into the Statement of Applicability alongside the 27002 controls.
Worked example
A processor already certified to 27001 wants the extension. It extends its risk assessment to include risks to PII principals, adds the Annex B controls to its Statement of Applicability with inclusion and exclusion justifications, documents customer instructions and disclosure records, and is then audited in an integrated certification and surveillance cycle.
Traps that cost marks
- Believing 27701 can be certified on its own, or that it replaces 27001.
- Treating the GDPR mapping annex as legal advice or a compliance certificate.
- Mixing clause numbers between the 2019 and later editions.
- Forgetting that Annex A and B controls must appear in the Statement of Applicability.