Does ISO 27701 with ISO 27001 cost more than ISO 27001 alone?
A customer or contract asks for privacy certification on top of ISO 27001, and the first question is what the extra standard adds to the bill. ISO/IEC 27701:2025 is a separate, certifiable management system standard for organizations that act as PII controllers or PII processors. ISO prices it at CHF 225 on its own and sells a bundle with ISO/IEC 27018:2025 and ISO/IEC 27001:2022 at CHF 486. The standard price is rarely the real cost. Your certification spend will depend on the scope of the privacy management system, the number of PII processing activities you must document and test, and whether the certification body audits the privacy system during the same visit as the ISMS or in a separate engagement.
Ask each certification body for a quote that separates the ISMS audit days from the privacy audit days, and confirm whether the two are assessed together. Ask which processing activities, data flows and processor relationships they expect you to cover, because each one adds evidence to collect and sample. Also confirm how the 2025 edition will be applied to your existing ISO/IEC 27001:2022 certificate and whether the scope statement must name both systems. Internal effort is often larger than the audit fee: you will need records of processing, data subject request handling, and processor agreements that match the privacy controls.
ISO does not certify organizations. Accredited certification bodies issue certificates, and DeployOpen prepares systems and evidence for that assessment without issuing reports or certificates. If you bring in an implementation partner, agree the fixed scope, deliverables and timeline in writing so you can compare the partner's fee with the change in audit effort. Confirm the independence rules with your certification body before work starts, so the party that builds the privacy evidence is not also the party judging it.
Should privacy certification sit beside ISO 27001 or on its own?
An organization that already holds an ISO/IEC 27001 certificate usually adds a privacy information management system (PIMS) to the existing management system. The first decision is scope. The ISMS certificate covers a defined boundary of information, systems and sites, and the privacy scope must be stated separately: either it matches that boundary or it covers a narrower set of processing activities where the organization acts as a PII controller or processor. ISO/IEC 27001:2022 and ISO/IEC 27701:2025 both build on the Annex SL high-level structure, so the same clauses, from context through performance evaluation and improvement, already run in the organization. The certification body then audits the privacy-specific requirements and checks that the shared processes cover the added scope.
- Scope boundary: Decide whether the privacy scope equals the ISMS scope or sits inside it, and write that boundary into both scope statements.
- Shared clauses: Context, leadership, planning, support, operation, performance evaluation and improvement have identical subclause titles and text in both standards, so one set of management reviews, internal audits and corrective actions can serve both.
- What the body audits: Privacy-specific requirements and PII controls, plus evidence that the existing ISMS still operates across the expanded scope.
- Certificate edition: Confirm the current certificate is to the 2022 edition, because certificates to the 2013 edition had to expire or be withdrawn by 31 October 2025.
Ask the certification body whether it will issue a separate privacy certificate or add scope to the existing one, and how surveillance audits will cover both.
An organization starting from no certificate can plan ISO/IEC 27001 and ISO/IEC 27701:2025 as one program. Because the two standards share Annex SL subclause titles and text, a single set of clauses can be designed once and then tested against both requirement sets. ISO describes the 2025 privacy edition as aligned with existing ISO/IEC 27001 systems, which makes a combined build practical, but the certification body still audits each standard against its own requirements. Planning therefore has to answer two questions early: which risk assessment, policies and records serve both standards, and which privacy controls need their own evidence.
- One risk process: Build a single risk assessment that identifies security risks and risks to individuals from PII processing, with separate treatment decisions where they differ.
- Shared documentation: Policies, the document register and management review minutes can cover both standards if each requirement is traceable to the clause it satisfies.
- Control mapping: Confirm how the body wants privacy controls recorded alongside the Annex A controls in the Statement of Applicability.
- Audit days: Ask whether the body runs a combined audit, how many days it expects, and whether the two certificates carry the same expiry.
- Bundled standards: ISO sells ISO/IEC 27701:2025, ISO/IEC 27018:2025 and ISO/IEC 27001:2022 as a bundle at CHF 486, which may be relevant if cloud PII processing is in scope.
Before engagement, confirm in writing with the certification body how it will schedule and report a combined audit.
An organization that needs privacy certification but holds no ISMS certificate can pursue ISO/IEC 27701:2025 on its own. ISO describes the 2025 edition as an independent management system standard that can be used alone, so an ISMS certificate is not a prerequisite. The scope decision then covers only the processing activities where the organization is a PII controller or processor. The gap is the security baseline. The privacy standard still depends on information security controls to protect PII, and the body will expect evidence that those controls operate, even if they are not certified under ISO/IEC 27001.
- Standalone scope: Define the PIMS boundary around specific processing activities, systems and suppliers that handle personal data.
- Security baseline: Confirm which security controls the body expects to see and whether it requires a documented mapping to ISO/IEC 27001 Annex A.
- GDPR certification is separate: Article 42 and Article 43 of the GDPR describe a distinct EU route. Certification bodies there are accredited under EN-ISO/IEC 17065/2012 plus supervisory authority requirements, for a maximum of five years. Check the EDPB register before assuming equivalence.
- Current edition: ISO/IEC 27701:2019 is withdrawn, so confirm the assessment is against the 2025 edition.
Ask the certification body whether it certifies to ISO/IEC 27701:2025 without an ISMS certificate, and request its written requirements for the security evidence it will test.
What makes an ISO 27701 project cost more or less
The cost of an ISO 27701:2025 project follows from how much personal data processing the privacy management system must cover and how much of that work already exists in an ISO 27001 ISMS. Each driver below can be shaped before work starts, and each one should appear in a written quote.
Number of PII processing activities
Each processing activity, such as payroll, customer support, marketing or product analytics, needs its own record, lawful basis, retention rule and set of privacy controls. A short register of ten activities costs far less to document, test and evidence than one covering several hundred. Ask the organization to inventory activities and systems before requesting a quote, and ask the quote to state how many activities and systems it assumes. The activity count is the single biggest input to effort.
Number of sites and business units
Each site, subsidiary or business unit that processes PII may need its own owners, procedures, records and sampling during the certification audit. Multi-site scope usually means more audit days and more evidence to collect. Confirm early which entities are inside the privacy scope and which are excluded, and ask the quote to show how each in-scope location is sampled and who gathers its evidence.
Controller, processor or both
ISO 27701:2025 sets requirements for PII controllers and processors, and an organization acting in both roles carries two sets of obligations. Processor work includes customer instructions, subprocessor handling and returning or deleting data at contract end. Decide the roles per activity before scoping, because a mixed role roughly adds a second body of requirements to build and evidence. Ask the quote to name which role each activity is assessed under.
State of existing ISO 27001 evidence
An organization with a working ISO 27001 ISMS already has a risk assessment, Statement of Applicability, policies, access reviews and internal audit records. Those can be extended to cover personal data rather than rebuilt. Where the ISMS is immature or its records are scattered, the privacy project absorbs the cost of the missing foundation. Ask for a gap review of current ISMS evidence as the first deliverable, and ask the quote to separate new work from extensions of existing records.
Third-party processors and subprocessors
Every processor, cloud host or subprocessor that touches personal data adds contract review, transfer assessment and evidence collection. GDPR Article 28 expects written terms with processors, and a large supplier list multiplies that work. Build a single register of processors with contract status and transfer mechanism before the project starts. Ask the quote whether supplier due diligence and contract reviews are included or left to the organization's legal team.
Combined or separate audit
Running the ISO 27701 assessment alongside an ISO 27001 certification audit usually shares sampling, interviews and document review, which can reduce total audit days compared with two separate engagements. A standalone privacy audit repeats some of that work. Confirm with the chosen certification body how it will combine the audits and what it will charge for each, and ask the implementation partner to prepare one evidence set that serves both.
How the ISO 27701 certification process runs alongside ISO 27001
The sequence starts with knowing where personal data flows and ends with an accredited certification body deciding whether the combined privacy and security management system meets the standards. Each phase hands a defined output to the next, so the work is not repeated for the ISO 27001 and ISO 27701 audits.
Define scope and inventory PII processing
The organization decides which entities, business units, systems and processing activities fall inside the privacy information management system, and whether it acts as a PII controller, a PII processor or both. Its privacy and data teams then record each processing activity, the categories of personal data involved, the purposes, the systems that hold the data and the third parties that receive it. The output is a documented PII processing inventory and a scope statement that the ISO 27001 information security scope must match or fit within. You know this step is done when the data owners have signed off the inventory and every system in scope is traceable to at least one processing activity.
Run a gap assessment against both standards
An internal team or an independent adviser compares current practice with the requirements of ISO/IEC 27001:2022 and the privacy extension in ISO/IEC 27701:2025, and notes where GDPR-relevant obligations such as lawful basis records, data subject request handling and processor contracts are not yet evidenced. Because the two standards share the high-level structure, one gap list can cover shared items such as context, leadership, risk and internal audit. The output is a gap register with each gap tied to a clause or control, an owner and a remediation action. You know this step is done when every requirement in scope has a status and no requirement is left unassessed.
Assess privacy and security risks
The organization sets its risk criteria and identifies risks to confidentiality, integrity and availability of information, and to the rights and freedoms of individuals whose PII is processed. It then selects treatment options and records them in a Statement of Applicability for the ISO 27001 Annex A controls and in the privacy control records for the 27701 requirements. The output is a risk assessment report, a risk treatment plan and an updated Statement of Applicability. You know this step is done when each treatment option links to an owner and to a control that can be evidenced.
Implement controls and collect evidence
Control owners put the selected security and privacy controls in place, such as access restrictions on personal data stores, retention and deletion routines, processor agreements and breach response procedures, and they keep records as the controls run. Where tooling is used, such as logging, ticketing or self-hosted GRC software, the configuration and its outputs become part of the evidence set. The output is a control implementation record with dated evidence for each control in the Statement of Applicability. You know this step is done when a reviewer who did not build the control can follow the evidence trail from requirement to output.
Perform an internal audit and management review
An auditor who is independent of the controls being checked tests the combined management system against both standards and records nonconformities, observations and opportunities for improvement. Top management then reviews performance, audit results, privacy complaints, incidents and risk changes, and decides on actions and resources. The output is an internal audit report with corrective action records and minutes of the management review. You know this step is done when every nonconformity has a closed corrective action or an agreed plan, and the management review minutes record decisions.
Complete the certification body stage 1 audit
The accredited certification body reviews the documented management system, including the scope, the PII processing inventory, the risk assessment, the Statement of Applicability and the policies, to judge whether the organization is ready for a full assessment. The auditor may raise points that must be addressed before stage 2. The output is a stage 1 report that identifies readiness gaps and sets out what must be resolved. You know this step is done when the certification body confirms that the documentation is adequate for the stage 2 assessment and any gaps are closed.
Complete the certification body stage 2 audit
The certification body tests whether the controls operate as documented, by sampling records, interviewing staff, observing processes and checking how privacy and security requests are handled in practice. Nonconformities are graded and must be corrected before a certification decision can be made. The output is a stage 2 audit report with any nonconformities and the organization's responses. You know this step is done when the audit team has tested the in-scope processing activities and each nonconformity has an accepted corrective action.
Receive the certification decision and maintain the cycle
An impartial decision-maker at the certification body, separate from the audit team, reviews the audit file and decides whether to issue the certificate. Under ISO/IEC 17021-1, a management system certification cycle runs for three years, with at least one audit, either surveillance or recertification, in every calendar year, so the organization schedules those audits as part of ongoing operations. The output is the certificate and its scope statement, followed by an annual audit plan. You know the decision is complete when the certificate is issued and the certification body's registry lists it. Confirm with the certification body whether the certificate covers ISO/IEC 27701:2025 and ISO/IEC 27001:2022 as separate certificates or as a combined statement.
How ISO 27701 relates to GDPR expectations
A privacy certificate supports accountability but does not discharge the legal duties of a controller or processor. GDPR refers to certification in several places: Article 24 and Article 25 point to approved mechanisms as a way to demonstrate compliance, Article 28 and Article 32 connect processor assurance and security to those mechanisms, and Articles 42 and 43 set out certification mechanisms and the certification bodies that issue them. Those provisions describe how certification can be used as evidence. They do not state that a certificate removes liability, and a certificate issued against ISO/IEC 27701:2025 is a management system certification, not a GDPR approval. Organizations should treat it as one input to demonstrating accountability, alongside records of processing, impact assessments and breach handling.
The European Data Protection Board (EDPB) keeps a public register of certification mechanisms, seals and marks, and its Guidelines 1/2018 explain how certification criteria are identified and approved. Before relying on any scheme, check whether it appears in that register and whether it is an approved GDPR mechanism or a private standard. The EDPB has also reported that the first European data protection seal was approved as a tool for transfers in April 2026, which is a different instrument from an ISO management system certificate. Confirm with the EDPB news item and your supervisory authority which mechanism, if any, covers your transfers before citing it in a contract or transfer assessment.
Ask counsel or your supervisory authority three questions before scoping an ISO 27701 project: whether your processing makes you a controller, a processor or both; which GDPR articles your current evidence already covers; and whether a certification mechanism would reduce the work your customers request. Document the answers in the privacy information management system scope and the statement of applicability so that the certificate, the contract terms and your records describe the same processing. Any assumption about regulator acceptance should be written down as an open item, not treated as settled.
Which combination fits: ISO 27001 only, 27701 added, or the 27018 bundle
This table compares three certification paths for privacy-related scope: ISO 27001 alone, ISO 27001 with ISO/IEC 27701:2025 added, and the bundle of ISO/IEC 27701:2025, ISO/IEC 27018:2025 and ISO/IEC 27001:2022. Read each row against your own role as a PII controller, processor or both, and use the questions in the last row before you ask a certification body for a quote. The main takeaway is that the bundle is a purchase convenience, not a scope decision.
| Option | When it fits | Extra scope it creates | Questions to ask the certification body |
|---|---|---|---|
| ISO 27001 only | Your main exposure is information security, and privacy obligations are handled through contracts and policies rather than a certified privacy management system. | Clause 4 to 10 requirements and the Annex A controls covering personal data as one information asset among others. | Does the certificate scope cover the systems that hold personal data, and how will you test controls that touch PII? |
| ISO 27001 with ISO/IEC 27701:2025 added | You act as a PII controller or processor and customers or regulators expect a documented privacy information management system alongside the ISMS. | A privacy information management system with its own requirements for PII controllers and processors, integrated with the ISMS under the shared management system structure. | Will you audit the privacy requirements in the same audit visit, and which privacy processes will the auditor sample? |
| Bundle: ISO/IEC 27701:2025, ISO/IEC 27018:2025 and ISO/IEC 27001:2022 (CHF 486 from ISO) | You are a public cloud provider acting as a PII processor, or a cloud service that stores customer personal data and must show public cloud PII protections. | Adds the public cloud PII protection guidance of ISO/IEC 27018:2025 on top of the privacy and security scope. The bundle price covers the standards, not the audit. | Is the ISO/IEC 27018 scope tied to the cloud service, and how will you handle customer-facing PII commitments and subprocessors? |
| Who must decide | Usually the CISO or privacy lead, with legal input on controller or processor roles under GDPR Articles 24 and 28. | Adds privacy governance, PII inventories and processing records to the audit evidence. | Confirm the role split with counsel before the certification body reviews your scope. |
| One-time vs recurring effort | ISMS build and audits recur on the certification cycle; the standards purchase is one-time. | Added work is mainly privacy documentation and staff training, then recurring surveillance. | Ask which audit days and sampling change if privacy is added, and get that in writing. |
| Confirm before buying | Check that the standard edition you need is current, since ISO/IEC 27701:2019 is withdrawn. | Check the bundle includes the editions your certification body accepts for the audit. | Ask the certification body for its accreditation scope and whether it applies ISO/IEC 27006-1:2024 to your audit. |
Who owns the privacy controls, who prepares evidence and who certifies
The organization that processes personal data owns its privacy information management system, its legal positions and every decision that determines how personal data is handled. No outside party can accept those responsibilities on its behalf, and an auditor will look first for evidence that leadership made and recorded them.
- PII inventory and processing records: The organization decides which personal data it holds, why, where it flows and which systems and suppliers touch it.
- Legal basis and purpose decisions: Lawful bases, retention periods and data subject rights handling are decided and approved by the organization, with its legal or privacy function.
- Roles and accountability: Named owners, a privacy lead and management sign-off on the privacy policy, risk treatment and the scope of the management system.
- Control operation: Staff run access reviews, incident handling, supplier assessments and training every day, and the organization keeps the records.
- Management review and improvement: Leadership reviews performance and approves corrective actions.
Before any engagement, confirm that the organization has named an accountable owner for each privacy decision, since that owner will be the one answering auditor questions about them.
An implementation partner such as DeployOpen prepares the systems, documentation, technical controls and evidence that the organization then operates. Under a fixed-scope engagement, the partner's deliverables and the organization's responsibilities are written down before work starts. The partner builds the environment; it does not decide the privacy outcomes or certify them.
- Technical controls inside the client environment: Self-hosted open-source platforms are deployed, hardened and configured in the client's own cloud accounts, data centers or air-gapped networks, with logging and access controls that generate evidence.
- Documentation drafts: The partner can draft procedures, records templates and system descriptions for the organization to review, adapt and approve.
- Evidence preparation: Configuration baselines, access logs, backup test results and change records are organized so the organization can present them.
- Gap support and tooling: The partner helps map existing controls to the standard's requirements, but the organization accepts the mapping.
- Independence limits: The partner cannot audit its own work, so it does not perform the internal audit that the standard requires the organization to run, and it does not issue any report or certificate.
Check the scope document for a clear line between work the partner delivers and work the organization must perform and sign off.
An accredited certification body is the only party that issues an ISO/IEC 27701 certificate after an independent audit. The body is accredited to apply the certification standards to its clients, and it must be independent of the organization and of any consultant who helped prepare it. ISO itself does not certify organizations.
- Independent audit: Auditors test the management system against the requirements, sample records and interview staff, and they report findings without help from the implementation partner.
- Nonconformities and decisions: The body raises nonconformities that the organization must correct, and its certification decision is separate from the advice the organization received.
- Accreditation: Accredited bodies operate to ISO/IEC 17021-1:2015 plus ISO/IEC 27006-1:2024, which IAF MD 29:2024 required them to apply to all clients by 31 March 2026. Accreditation is checked through the IAF CertSearch database that ISO points to.
- Certificate validity: Management system certificates run on a three-year cycle with at least one audit in each calendar year, so the organization maintains its system continuously.
- Scope of the certificate: The body certifies only the scope the organization defined and the body audited.
Before signing, confirm the body's accreditation scope covers privacy information management and that the auditors have no role in designing your controls.
How to choose a certification body and an implementation partner
A certification body issues the certificate and an implementation partner prepares your systems and evidence, so the two roles must stay separate. The cards below cover the checks that confirm an accredited body, test its independence from your implementer, and show how the privacy scope and any combined audit are priced before you commit.
Confirm accreditation with the national body
Ask the certification body which accreditation body granted its scope and check that the accreditation covers ISO/IEC 27001 and the privacy extension, not only a general management system scope. Ask for the accreditation certificate and its scope schedule. Accreditation bodies are the ones that confirm a certification body is competent, so a body that cannot show a current scope should not audit your privacy information management system.
Search the IAF CertSearch database
Before signing, look up the certification body and any certificate it has issued in the IAF CertSearch database, which ISO points to for checking accredited certificates. Since 1 January 2026, Global ACI has assumed the roles of IAF and ILAC, so confirm the listing reflects current arrangements. Verify that the certificate names the standards and scope you expect, and ask the body to confirm the audit team's qualifications in writing.
Check the transition to ISO/IEC 27006-1
Accredited ISMS certification bodies must apply ISO/IEC 17021-1 together with ISO/IEC 27006-1:2024 to all clients under the IAF transition rules. Ask the body how its audit plan, auditor competence and sampling apply both standards, and how it treats the privacy controls in ISO/IEC 27701:2025 during an ISO 27001 audit. A body that cannot explain this mapping is not ready for a combined audit.
Separate the auditor from the implementer
The organization owns its controls and its privacy records, the implementation partner prepares them, and the certification body audits them. Ask whether the body has provided consulting, gap analysis or pre-audit support to you in the past two years, and whether any of its staff designed the controls it will test. A certification body that also builds your privacy processes cannot independently judge them, so ask for this in writing before scoping begins.
Match privacy experience to your processing role
Ask whether the auditors have hands-on experience with PII controller or PII processor obligations, depending on your role, and with the GDPR articles that shape your controls, such as security of processing, data protection by design, and processor contracts. Request the names and privacy background of the proposed audit team. For a processor, ask how the body assesses processor instructions and sub-processor management, not only generic information security controls.
Ask how the bundle is priced
ISO sells ISO/IEC 27701:2025, ISO/IEC 27018:2025 and ISO/IEC 27001:2022 as a bundle at CHF 486, but that is the price of the documents, not of certification. Ask each body to split its quote into audit days, stage 1 and stage 2 work, any combined or integrated audit discount, certificate issuance, and annual surveillance fees. Confirm whether a combined audit reduces days or only the number of visits, and whether the ISO 27018 cloud scope is audited separately.
Questions buyers ask about ISO 27701 and ISO 27001
Can an organization hold ISO 27701 certification without ISO 27001?
No. ISO/IEC 27701:2025 is written as an extension of an information security management system, so a certification body expects the organization to hold, or be certifying to, ISO/IEC 27001:2022 at the same time. ISO describes the 2025 edition as an independent management system standard that can be used alone, and it states that it aligns with existing ISO/IEC 27001 systems. Confirm with your chosen certification body how it will assess a privacy-only scope, since its accreditation rules and its own procedures decide what is accepted. Most organizations plan the two together because the privacy controls build on the security controls the ISMS already runs.
What do the CHF 225 and CHF 486 prices from ISO cover?
The CHF 225 price is for the ISO/IEC 27701:2025 standard document itself, a 64-page edition published in October 2025. The CHF 486 price is ISO's bundle of ISO/IEC 27701:2025, ISO/IEC 27018:2025 and ISO/IEC 27001:2022, so it covers three standards for one price. Neither figure includes certification audit fees, internal staff time, tooling, consultant support or the certification body's annual charges. Those costs come from the certification body's written quote and from your own effort to build the management system. Ask any certification body or implementation partner to itemize its quote by audit days, document review and ongoing surveillance.
How long does an ISO 27701 certification cycle last?
A certification cycle under ISO/IEC 17021-1 lasts three years. Within that cycle, the certification body must carry out at least one audit in every calendar year, either a surveillance audit or the recertification audit. This pattern applies to management system certifications generally, so a privacy certification that runs alongside ISO 27001 follows the same rhythm. Budget for the recurring surveillance audits, not only the first certification audit, and confirm with the certification body how it schedules combined audits for the two standards. Also check the accreditation of the certificate, since accredited certification bodies must apply ISO/IEC 27006-1:2024 to all clients by 31 March 2026.
What must the internal team provide for an ISO 27701 audit?
The team must provide evidence that the privacy information management system exists, runs and improves. In practice this includes a defined scope covering the personally identifiable information the organization processes, its role as a controller, a processor or both, and the records that show how each privacy control operates. Expect to supply the ISO 27001 ISMS documentation first, including the risk assessment, Statement of Applicability, policies, access records, incident logs and internal audit results, then the privacy-specific records such as processing inventories, data subject request handling, and processor agreements. Named owners for each control, and records of management review, are what auditors usually ask for first.
Can a small team run ISO 27701 with ISO 27001?
A small team can run it if it has a clear scope, a limited set of processing activities and a named owner for privacy and security. The workload grows with the number of systems that hold personal data, the number of processors and sub-processors, and the number of data subject requests. A small organization that already runs an ISMS for its customers usually adds fewer new records than one starting from zero. Many small teams use an external implementation partner for setup and evidence preparation, while keeping decisions, sign-off and ownership of each control in-house. Be realistic about the staff hours required each month, because surveillance audits and control evidence recur for the life of the certificate.
How does ISO 27701 differ from GDPR compliance?
ISO 27701 is a certifiable management system standard, while the GDPR is a regulation that the organization must comply with whether or not it is certified. A certificate can show an assessor that a privacy management system exists and operates, and the GDPR allows approved certification mechanisms and seals to be used as one way of demonstrating compliance with certain obligations under Articles 42 and 43. It does not, by itself, make an organization compliant with every GDPR duty, such as lawful basis, data subject rights or transfer rules. Treat the certificate as supporting evidence for accountability and security obligations, and confirm with your data protection officer or counsel which GDPR articles it covers.
How can a buyer verify an ISO 27701 or ISO 27001 certificate?
Check that the certificate was issued by an accredited certification body, then confirm its status in the registry that ISO points to for accredited certificates. ISO's certification guidance refers to the IAF CertSearch database, and since 1 January 2026 Global ACI has assumed the roles of IAF and ILAC, so confirm the current accreditation body's listing for the certification body. Verify the certificate number, scope, issuing body, validity dates and the standard edition named on it. Be cautious with certificates that do not name an accredited body or that describe a scope broader than the one actually audited. Ask the supplier to share the scope statement and the Statement of Applicability for a full review.
How DeployOpen prepares systems and evidence for ISO 27701 with ISO 27001
DeployOpen prepares the systems, documented controls and evidence that an organization needs before an independent certification body assesses its privacy information management system alongside its ISO 27001 ISMS. The organization keeps ownership of its controls and decisions, and an accredited certification body alone issues any certificate.
How we scope
- Agree in writing which ISO 27001 ISMS and ISO 27701:2025 PIMS boundaries, sites and PII processing activities the work covers.
- Map the controller and processor roles the organization holds for each processing activity, so the scope matches the contracts and records.
- Confirm the target certification body and its accreditation scope before the written scope and deliverables are signed.
How we build
- Configure self-hosted open-source platforms inside the client's own infrastructure to run access, logging and retention controls for PII.
- Draft privacy and security policies, the Statement of Applicability and records of processing that the organization reviews and approves.
- Test the controls against the requirements and record results so an assessor can trace each control to its operating evidence.
How we hand over
- Deliver the configuration, runbooks, policies and evidence register in formats the organization's own staff can maintain.
- Walk the organization's control owners through each control, its evidence and the questions an assessor is likely to ask.
- Confirm that the organization holds the accounts, keys and administrative access needed to operate the platforms after handover.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after the fixed-scope engagement closes.
- Support the organization through its certification body's audit questions, while the auditor makes its own findings.
- Ask the organization to confirm the retainer scope, response expectations and ownership of documentation in the written agreement.
