ISO 27701 Consulting Services

Privacy Information Management System (PIMS) Strategy/Framework Selection – Defining the ideal approach to PIMS development based on your industry, regulatory compliance and attestation requirements.

PIMS Scope Determination and Optimization – Scope determination is key to the critical task of “data mapping” which forms the basis of a successful ISO 27701 implementation effort. The scope needs to be broad enough to meet the needs key stakeholders (e.g., clients, shareholders) but narrow enough to keep the initial effort manageable.

Risk Assessment/Data Privacy Impact Assessment – Risk Assessment/Management is a cornerstone of every ISPMS. ISO 27701 extends your Risk Assessment methodology to allow it to be used for both Information Security & Privacy Risk Management.

PIMS Gap/Control Maturity Assessment – Understanding the difference between your current privacy posture and the desired state of your ISPMS is a vital starting point for Risk Treatment Plan development and your eventual “Prioritized Roadmap” (Gap Remediation Plan).

Risk Treatment Plan Development – The Risk Treatment Plan specifies the controls required for your ISPMS, (including the needed extent and rigor of their implementation) to mitigate privacy risk to a level that your organization’s management team considers acceptable.

Gap Remediation Facilitation/Support – Collaboratively, we will execute the Risk Treatment Plan to close identified gaps in your ISPMS to position you for successful certification.

Privacy Metrics – Metrics are central to a robust ISPMS implementation as they are essential to demonstrate continuous improvement (a key tenet of ISO 27001 certification). This service focuses on simplifying the process of measuring, reporting and hence systematically improving your ISPMS’ effectiveness.

Policy, Standards, & Procedure (PSP) Support – PSPs form the mainstay of any ISPMS. But while PSPs are relatively simplistic ISPMS elements, they are not simple to implement well. Important points to consider before implementing PSPs include structure, presentation, audience, version control and more. If the target audience can’t easily find all the information relevant to the specific issue at hand, a nonconformity is likely to be issued.

ISPMS Internal Audit – Integral to the 27001 requirement of validating the effectiveness of the ISPMS is a requirement to conduct an internal audit to establish whether its control objectives, controls, processes and procedure conform to requirements, are effectively implemented and maintained, and perform as expected.

Certification Audit Support – For many clients, having a Pivot Point Security auditor on-site during one or both of the ISO 27001 certification audit phases streamlines the process and reduces the risk of non-conformities.

Ongoing Risk Management Team Membership – Making sure you have the right people on your Risk Management Committee is critical to the ongoing effectiveness of the Risk Management function, which is critical to the ongoing effectiveness of the ISMS and PIMS. Many clients benefit from including an independent, objective third-party member with broad organizational/industry expertise on their Risk Management Committee.