Duration
2 days
Course Aim
To provide a typical framework for extending your ISO/IEC 27001 information security management system (ISMS) including the more specific requirements and guidance for protecting your organization’s personally identifiable information (PII), together constituting a privacy information management system (PIMS).
Course Description
ISO/IEC 27701:2019 specifies the requirements and provides guidance for implementing a privacy information management system (PIMS) in the form of an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy management, within the context of your organization.
By attending our two-day course, you will understand how to implement the principles of ISO/IEC 27701:2019 and the required changes to extend your ISMS. It will help you understand how the requirements of ISO/IEC 27701 provide the basis of an effective PIMS and provides guidance for personally identifiable information (PII) controllers and/or processors, processing PII.
With the full support of a world-class BSI tutor, you’ll learn about ISO/IEC 27701:2019 common terms and definitions, as well as the how to implement the key concepts and requirements.
How will I benefit?
This course will help you to:
- Recognize how to extend an ISO/IEC 27001 ISMS to include specific requirements for protecting your PII and implementing a PIMS (addressing both information security and privacy protection)
- Identify where adjustments might need to be made to your ISMS to accommodate your situation and progress made to date, in respect of protecting privacy
- Increase your knowledge of the requirements and guidance contained within ISO 27701, from an implementation perspective
Your learning will be through an activity-based, delegate-centred approach. This will help you share experiences and knowledge with other attendees; bringing alive the information presented and resulting in enhanced retention and application to your own workplace.
What will I learn?
The course covers the following specific learning objectives:
Knowledge:
- Recognize a typical framework for extending your ISO/IEC 27001 ISMS to include specific requirements and guidance for protecting personally identifiable information (PII) and implementing a PIMS
- Interpret key requirements and guidance of ISO/IEC 27701 from both a PII controller and processor implementation perspective
- Identify the benefits to your organization of implementing an ISO/IEC 27701 PIMS
Skills:
- Conduct a gap analysis of your organization’s current compliance with the requirements of ISO/IEC 27701
- Implement the key requirements and guidance of ISO/IEC 27701
Who should attend?
Anyone involved in planning, implementing, maintaining or supervising an ISO/IEC 27701 PIMS. The course is equally relevant to PII controllers and PII processors.
How will I learn?
Our unique, accelerated-learning approach fast tracks learning by improving your knowledge retention and skill application. This course involves practical activities, group discussions and classroom learning to help you develop a deeper understanding of the material and have a greater impact on job performance.
Prerequisites
You should already have a good knowledge of implementing an ISMS based on ISO/IEC 27001 and ISO/IEC 27002 and be looking to extend your ISMS to include privacy information management.
A good knowledge of PIMS requirements and terminology is recommended. You should have previously attended an ISO/IEC 27701 requirements course and we also recommend that you understand whether a PIMS is currently employed in your organization.
Agenda
Day 1
Time
Topic
9:00
17:00
Benefits to you, welcome and introductions
Course aim, objectives and structure, ISO 22301 refresh quiz
Background to ISO/IEC 27701
Benefits of implementing ISO/IEC 27701 Key terms and alternative terms
What is a PIMS?
PIMS Plan, Do, Check Act (PDCA) Cycle Implementing a PIMS
Overall project management process and link to PDCA
Integration – High level structure Project plan
Documentation
Clause 5: PIMS-specific requirements related to ISO/IEC 27001
Clause 6: PIMS-specific guidance related to ISO/IEC 27002
End of day 1
Day 2
Time
Topic
9:00
17:00
Day 1 refresher quiz
Clause 7: Additional ISO/IEC 27002 guidance for PII controllers
Clause 8: Additional ISO/IEC 27002 guidance for PII processors
Annexes
Continual improvement
Review and final questions, feedback
End of course
Programme scope, delivery arrangements and suitability are confirmed during enquiry.