ISO 27701 Certification

ISO 27001 covers your overall information security management system. ISO 27701 covers privacy specifically - how your organization handles personally identifiable information. If you only have ISO 27001, your security posture is audited but your privacy program isn't independently verified. They address different buyer and regulatory concerns, and increasingly enterprise contracts require both.

Yes - the 2025 revision made ISO 27701 a standalone standard, so ISO 27001 is no longer a hard prerequisite. That said, if you have neither, pursuing both together is usually more efficient. The documentation and control work overlaps significantly, and a combined engagement avoids duplicating scoping and audit effort. We'll walk you through the tradeoffs during the scoping call.

Most engagements run two to four months from kickoff to certificate issuance. The main variables are how mature your existing privacy controls are and whether you're pursuing it alongside ISO 27001. We give you a realistic timeline during the scoping call based on your actual current state - not a best-case scenario.

That's common. The Stage 1 audit reviews your documentation and identifies gaps before we move into the implementation assessment. Any nonconformances found in Stage 2 go through a resolution process before certification is issued. We tell you exactly what needs to be addressed and work with you through it.

Significantly, yes. ISO 27701 maps directly to both GDPR and CCPA requirements at the control level. In practice, most organizations that have gone through a serious GDPR implementation have satisfied a substantial portion of the PIMS requirements. During scoping we review what you have so you're not rebuilding work you've already completed - and so we can give you an accurate picture of the remaining gap before you commit to the engagement.