What is the difference between ISO 27701 and 27001?

What is the difference between ISO 27701 and 27001?

ISO/IEC 27001 and ISO/IEC 27701 are two related standards that deal with information security and privacy management systems, respectively. ISO/IEC 27001 is a standard for Information Security Management Systems (ISMS), while ISO/IEC 27701 is a privacy extension to ISO/IEC 27001 that focuses specifically on Privacy Information Management Systems (PIMS).

The primary difference between the two standards is their focus. ISO/IEC 27001 deals with the management of information security risks, while ISO/IEC 27701 deals with the management of privacy risks.

ISO/IEC 27001 provides a framework for managing the confidentiality, integrity, and availability of an organization's information assets. It covers all types of information, including personal data, but does not provide specific guidance on how to manage privacy risks.

ISO/IEC 27701, on the other hand, provides specific guidance on managing privacy risks and complying with privacy laws and regulations. It builds on the framework provided by ISO/IEC 27001 and provides additional controls and requirements for managing personal data.

Another difference between the two standards is the scope of the certification. ISO/IEC 27001 certification covers the entire ISMS of an organization, while ISO/IEC 27701 certification covers only the PIMS within an organization.

In summary, ISO/IEC 27001 is a standard for information security management, while ISO/IEC 27701 is a privacy extension that focuses specifically on privacy management. ISO/IEC 27701 builds on the framework provided by ISO/IEC 27001 and provides additional controls and requirements for managing privacy risks and complying with privacy laws and regulations.