ISO 27001 vs ISO 27701

ISO/IEC 27001 specifies requirements for an information security management system (ISMS). ISO/IEC 27701 provides guidelines and requirements for a privacy information management system (PIMS) as an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy management.

In practice, 27701 builds on an ISMS; it is not a standalone substitute for 27001 in most certification pathways. Confirm current edition and certification rules with your CB.

Topic | ISO/IEC 27001 | ISO/IEC 27701 Primary focus | Confidentiality, integrity, availability of information | Privacy / PII processing controls extending the ISMS System name | ISMS | PIMS (as extension to ISMS) Controls artefact | Statement of Applicability against Annex A / 27002 controls | Additional privacy controls and guidance aligned to roles (PII controller/processor) Typical drivers | Cyber risk, customer security questionnaires, digital services | Privacy regulations, customer data processing agreements Certification reality | Widely offered ISMS certification | Often offered as extension where CB programmes exist — verify locally Depends on 27001? | Core standard | Designed as extension to 27001/27002

Organizations primarily needing structured information security risk management, access control, supplier security, and incident readiness often start with 27001. Many tender security sections reference 27001 explicitly.

Privacy obligations may still exist legally even without 27701 certification — certification choice does not erase law.

When you process personal data at scale, act as controller or processor under customer contracts, or need a structured PIMS mapped to privacy controls beyond generic ISMS treatment. 27701 helps demonstrate privacy governance sitting on the ISMS foundation.

Map roles carefully: controller vs processor obligations differ.

For 27001, the Statement of Applicability (SoA) records control decisions. Privacy extension work adds further control considerations. Do not treat the SoA as a paperwork chore — it is central audit evidence.

See our SoA glossary entry for a concise definition.

Digital businesses, financial services suppliers, cloud and IT service providers, and government contractors increasingly face security questionnaires referencing ISO/IEC 27001. Privacy expectations continue to rise with data protection frameworks — treat legal advice as separate from ISO consultancy.

Beyond Carbon supports ISMS/PIMS implementation readiness; CBs certify.

Beyond Carbon provides ISO consultancy, implementation support, documentation assistance, and audit preparation support. Independent certification bodies issue certificates after successful certification audits. Beyond Carbon does not present itself as a certification body or accreditation body.