bmad-plus 0.4.4 → 0.6.0

package/src/bmad-plus/packs/pack-shield/references/iso27701/regulatory-mapping.md

@@ -0,0 +1,229 @@
+# ISO 27701:2025 — Regulatory & Framework Mapping
+
+ISO/IEC 27701:2025 is designed to serve as a **compliance framework for multiple
+privacy regulations simultaneously**. The standard's updated correspondence annexes
+provide mappings to GDPR and other major privacy laws. This guide covers the most
+commonly requested mappings.
+
+---
+
+## GDPR (EU General Data Protection Regulation)
+
+ISO 27701:2025 provides the most detailed alignment with GDPR of any privacy
+management standard. Its updated correspondence annex maps controls directly to
+GDPR articles.
+
+### Key GDPR Principles → ISO 27701 Controls
+
+| GDPR Principle (Art. 5) | ISO 27701:2025 Controls |
+|------------------------|------------------------|
+| Lawfulness, fairness, transparency | A.1.2.3 (lawful basis), A.1.3.3–A.1.3.4 (transparency) |
+| Purpose limitation | A.1.2.2 (document purpose), A.1.4.3 (limit processing) |
+| Data minimisation | A.1.4.2 (limit collection), A.1.4.5 (PII minimisation) |
+| Accuracy | A.1.4.4 (accuracy and quality), A.1.3.7 (correction) |
+| Storage limitation | A.1.4.8 (retention), A.1.4.9 (disposal), A.1.4.6 (deletion) |
+| Integrity and confidentiality | A.3.26 (cryptography), A.3.25 (logging), A.3.9 (access) |
+| Accountability | A.1.2.9 (RoPA), SoA, privacy risk assessment, management review |
+
+### GDPR Rights → ISO 27701 Controls
+
+| GDPR Right | Article | ISO 27701:2025 Controls |
+|-----------|---------|------------------------|
+| Right to be informed | Art. 13–14 | A.1.3.3, A.1.3.4 |
+| Right of access | Art. 15 | A.1.3.9, A.1.3.10 |
+| Right to rectification | Art. 16 | A.1.3.7, A.1.3.8 |
+| Right to erasure (right to be forgotten) | Art. 17 | A.1.3.7, A.1.4.6, A.1.4.9 |
+| Right to restrict processing | Art. 18 | A.1.3.6, A.1.3.10 |
+| Right to data portability | Art. 20 | A.1.3.9 |
+| Right to object | Art. 21 | A.1.3.6 |
+| Rights re: automated decision-making | Art. 22 | A.1.3.11 |
+
+### GDPR Controller Obligations → ISO 27701 Controls
+
+| GDPR Obligation | Article | ISO 27701:2025 Controls |
+|----------------|---------|------------------------|
+| Lawful basis for processing | Art. 6 | A.1.2.3 |
+| Consent requirements | Art. 7 | A.1.2.4, A.1.2.5 |
+| Special categories of data | Art. 9 | A.1.2.3, A.1.2.6, A.1.4.5 |
+| Records of processing activities | Art. 30 | A.1.2.9 |
+| Data protection by design and default | Art. 25 | A.1.4.2–A.1.4.10 |
+| Joint controllers | Art. 26 | A.1.2.8 |
+| Processor contracts | Art. 28 | A.1.2.7 |
+| Data Protection Impact Assessment | Art. 35 | A.1.2.6 |
+| Personal data breach notification | Art. 33–34 | A.3.11, A.3.12 |
+| International transfers | Art. 44–49 | A.1.5.2–A.1.5.5 |
+
+### GDPR Processor Obligations → ISO 27701 Controls
+
+| GDPR Obligation | Article | ISO 27701:2025 Controls |
+|----------------|---------|------------------------|
+| Processing under contract | Art. 28(3) | A.2.2.2 |
+| Processing only on instruction | Art. 28(3)(a) | A.2.2.3, A.2.2.5 |
+| Confidentiality of processing | Art. 28(3)(b) | A.3.18, A.2.2.6 |
+| Security measures | Art. 28(3)(c) | A.3 (all security controls) |
+| Sub-processor controls | Art. 28(2), (4) | A.2.5.7–A.2.5.9 |
+| Assist controller with rights | Art. 28(3)(e) | A.2.2.6, A.2.3.2 |
+| Deletion or return at end | Art. 28(3)(g) | A.2.4.3 |
+| Provide information to controller | Art. 28(3)(h) | A.2.2.6 |
+| Records of processing activities | Art. 30(2) | A.2.2.7 |
+| Notify controller of breaches | Art. 33(2) | A.3.11, A.3.12 |
+| Law enforcement disclosure | Art. 28(3)(a) | A.2.5.5, A.2.5.6 |
+
+### How ISO 27701 Certification Supports GDPR Compliance
+
+ISO 27701 certification does not automatically mean GDPR compliance — GDPR also
+requires specific legal bases, DPO appointment in certain cases, supervisory authority
+registration, and so on. However, certification provides:
+
+- **Documented evidence** of privacy controls for regulatory investigations
+- **Accountability evidence** (Art. 5(2)) — demonstrating controls are in place
+- **Recognized framework** — supervisory authorities view ISO 27701 favorably
+- **DPA evidence** — SoA and control documentation can support DPIA requirements
+
+---
+
+## UK GDPR
+
+The UK GDPR (retained from EU GDPR post-Brexit) maintains near-identical requirements
+to EU GDPR. The same ISO 27701:2025 control mappings apply. The UK ICO has stated
+that ISO 27701 can be used as a Privacy Seal mechanism under UK GDPR Article 42.
+
+**Key UK-specific consideration**: The UK's International Data Transfer Agreement
+(IDTA) and UK Addendum to SCCs are different from EU mechanisms. A.1.5.2 must
+reference the appropriate UK transfer mechanism.
+
+---
+
+## CCPA / CPRA (California)
+
+The California Consumer Privacy Act (CCPA) and its amendment (CPRA) share many
+concepts with GDPR but have distinct requirements.
+
+| CCPA/CPRA Right or Obligation | ISO 27701:2025 Controls |
+|------------------------------|------------------------|
+| Right to know (categories and specific pieces) | A.1.3.9, A.1.3.10 |
+| Right to delete | A.1.3.7, A.1.4.6, A.1.4.9 |
+| Right to opt-out of sale/sharing | A.1.3.6, A.1.2.3 |
+| Right to correct | A.1.3.7, A.1.4.4 |
+| Right to limit use of sensitive PI | A.1.4.2, A.1.4.5 |
+| Right to non-discrimination | Not directly covered — process design |
+| Privacy notice (at collection) | A.1.3.3, A.1.3.4 |
+| Data minimisation | A.1.4.2, A.1.4.5 |
+| Service provider contracts | A.1.2.7 (equivalent to DPA) |
+| CPRA risk assessments | A.1.2.6 (PIA/DPIA) |
+| Contractor obligations | A.2 (processor controls) |
+
+**CCPA/CPRA notes**:
+- CCPA uses "consumer", "business", "service provider", "contractor", "third party"
+  — map these to ISO 27701's "PII principal", "PII controller", "PII processor"
+- CPRA's "sensitive personal information" category requires additional restrictions
+  (maps to A.1.4.2, A.1.4.5)
+- CPRA's mandatory risk assessments and cybersecurity audits align with A.1.2.6
+  and A.3.15
+
+---
+
+## LGPD (Brazil — Lei Geral de Proteção de Dados)
+
+Brazil's LGPD (effective August 2020) closely mirrors GDPR in structure.
+
+| LGPD Obligation | ISO 27701:2025 Controls |
+|----------------|------------------------|
+| Legal basis (Art. 7, 11) | A.1.2.3 |
+| Consent requirements (Art. 7–9) | A.1.2.4, A.1.2.5 |
+| Transparency / privacy notice (Art. 9, 18) | A.1.3.3, A.1.3.4 |
+| Data rights (Art. 18–20) | A.1.3.5–A.1.3.11 |
+| Data minimisation (Art. 6) | A.1.4.2, A.1.4.5 |
+| Data protection by design (Art. 46, 49) | A.1.4.2–A.1.4.10 |
+| Security measures (Art. 46) | A.3 (security controls) |
+| DPA / operator contracts (Art. 37–40) | A.1.2.7, A.2 |
+| Incident notification (Art. 48) | A.3.11, A.3.12 |
+| International transfers (Art. 33–36) | A.1.5.2–A.1.5.5 |
+| DPO (Encarregado) appointment (Art. 41) | Clause 5 (roles and responsibilities) |
+
+---
+
+## PIPEDA (Canada)
+
+Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) is
+structured around 10 Fair Information Principles. ISO 27701:2025 aligns well.
+
+| PIPEDA Principle | ISO 27701:2025 Controls |
+|-----------------|------------------------|
+| 1. Accountability | Clause 5 (leadership), management review, SoA |
+| 2. Identifying purposes | A.1.2.2, A.1.2.9 |
+| 3. Consent | A.1.2.3, A.1.2.4, A.1.2.5 |
+| 4. Limiting collection | A.1.4.2, A.1.4.5 |
+| 5. Limiting use, disclosure, retention | A.1.4.3, A.1.4.8, A.1.5.4 |
+| 6. Accuracy | A.1.4.4, A.1.3.7 |
+| 7. Safeguards | A.3 (security controls) |
+| 8. Openness | A.1.3.3, A.1.3.4 |
+| 9. Individual access | A.1.3.9, A.1.3.10 |
+| 10. Challenging compliance | A.1.3.10 (handling requests), Clause 10 |
+
+**Note**: Canada's Bill C-27 (Consumer Privacy Protection Act — CPPA) will replace
+PIPEDA when enacted. ISO 27701:2025 alignment will carry over as CPPA shares GDPR-
+influenced principles.
+
+---
+
+## PDPA (Singapore) and PDPA (Thailand)
+
+Both PDPAs are GDPR-influenced and align well with ISO 27701:2025.
+
+**Singapore PDPA key mappings:**
+| Singapore PDPA Obligation | ISO 27701:2025 Controls |
+|--------------------------|------------------------|
+| Consent obligation | A.1.2.3, A.1.2.4, A.1.2.5 |
+| Purpose limitation | A.1.2.2, A.1.4.3 |
+| Notification obligation | A.1.3.3, A.1.3.4 |
+| Access and correction obligations | A.1.3.9, A.1.3.7 |
+| Accuracy obligation | A.1.4.4 |
+| Protection obligation | A.3 (security controls) |
+| Retention limitation | A.1.4.8, A.1.4.9 |
+| Transfer limitation | A.1.5.2–A.1.5.5 |
+| Data breach notification | A.3.11, A.3.12 |
+
+**Thailand PDPA** follows a similar structure to EU GDPR and Singapore PDPA.
+The same control mappings apply.
+
+---
+
+## ISO 27001:2022 Integration
+
+ISO 27701:2025 is designed to work alongside ISO 27001:2022 even though it no longer
+requires it. When implementing both:
+
+- A.3 security controls can reference the organization's ISO 27001 ISMS controls
+  directly — no need to implement security controls twice
+- The ISO 27001 SoA and PIMS SoA can be maintained as separate documents or as a
+  combined document with role-based tabs
+- Risk assessments can be linked: ISMS risk assessment focuses on security risks;
+  PIMS risk assessment focuses on harm to PII principals
+- Internal audits can be combined for efficiency if scoped correctly
+- Management reviews can be combined with a dedicated privacy section
+
+**Key integration points:**
+| ISO 27701 Requirement | ISO 27001 Evidence That Can Be Referenced |
+|----------------------|------------------------------------------|
+| A.3.3 (IS Policies) | IS Policy (ISO 27001 Clause 5.2) |
+| A.3.9 (Access Rights) | Access control policy and records (A.5.15–5.18) |
+| A.3.11–A.3.12 (Incidents) | Incident response policy and records (A.5.24–5.28) |
+| A.3.26 (Cryptography) | Cryptography policy (A.8.24) |
+| A.3.27 (Secure SDLC) | Secure development policy (A.8.25–8.32) |
+| A.3.25 (Logging) | Logging and monitoring controls (A.8.15–8.16) |
+
+---
+
+## Framework Comparison Summary
+
+| Framework | Geographic Scope | Legally Binding? | ISO 27701 Alignment |
+|-----------|-----------------|-----------------|---------------------|
+| GDPR | EU/EEA | Yes — mandatory law | Excellent (dedicated correspondence annex) |
+| UK GDPR | United Kingdom | Yes — mandatory law | Excellent (same as EU GDPR) |
+| CCPA/CPRA | California, USA | Yes — mandatory law | Good (most rights and obligations covered) |
+| LGPD | Brazil | Yes — mandatory law | Excellent (closely mirrors GDPR) |
+| PIPEDA | Canada | Yes — mandatory law | Good (principles-based alignment) |
+| PDPA (Singapore) | Singapore | Yes — mandatory law | Good |
+| PDPA (Thailand) | Thailand | Yes — mandatory law | Good |
+| ISO 27001:2022 | Global | Voluntary standard | Direct integration supported |

package/src/bmad-plus/packs/pack-shield/references/iso27701/transition-guide.md

@@ -0,0 +1,219 @@
+# ISO 27701:2019 → 2025 Transition Guide
+
+Organizations certified under ISO 27701:2019 have until **October 2028** to transition
+to the 2025 edition. This guide covers the key changes, gap analysis approach, and
+the steps to a successful transition audit.
+
+---
+
+## Why the Standard Changed
+
+ISO 27701:2019 was designed as an *extension* to ISO 27001:2013 and ISO 27002:2013.
+When ISO 27001 and ISO 27002 were revised in 2022, ISO 27701 needed realignment.
+Rather than publishing another extension, ISO decided to rebuild ISO 27701 as a
+standalone Privacy Information Management System (PIMS) standard — removing the
+mandatory ISO 27001 prerequisite and making privacy management accessible to
+organizations that may not need or want a full ISMS.
+
+---
+
+## Structural Comparison
+
+| Element | 2019 Edition | 2025 Edition |
+|---------|-------------|-------------|
+| Standard type | Extension of ISO 27001:2013 | Standalone PIMS standard |
+| ISO 27001 prerequisite | Mandatory | Optional |
+| HLS framework | Derived from ISO 27001 | Own Clauses 4–10 |
+| Shared security guidance | Clause 6 — 90+ sub-clauses from ISO 27001/27002 | **Table A.3 — 29 rationalized controls** |
+| Controller controls | Annex A (Clause 7) — 28 controls | **Table A.1 — 31 controls** |
+| Processor controls | Annex B (Clause 8) — 16 controls | **Table A.2 — 18 controls** |
+| Annex A purpose | Controller-specific controls | Privacy controls for PII controllers |
+| Annex B purpose | Processor-specific controls | Implementation guidance (new) |
+| Implementation guidance | Minimal inline | **Dedicated Annex B** |
+| GDPR mapping | Annex D | Updated correspondence annex |
+| Control ID format | Clause-based (7.x.x, 8.x.x) | Table-based (A.1.x.x, A.2.x.x, A.3.x) |
+| Cloud/AI/IoT controls | Not explicitly covered | Added to 2025 control set |
+| New controls | — | 3 additional controller; 2 additional processor |
+
+---
+
+## Control Mapping: 2019 → 2025
+
+> **Note on 2019 control IDs:** ISO 27701:2019 used clause-based numbering (7.x.x for
+> controllers, 8.x.x for processors). The IDs in the tables below reflect that scheme.
+> For the authoritative, exhaustive control-by-control correspondence, consult
+> **Annex F of ISO 27701:2025** directly — it contains the official mapping table
+> between every 2019 and 2025 control.
+
+### Shared Security Controls (Clause 6 → Table A.3)
+
+In 2019, ISO 27701 incorporated all of ISO 27001/27002's control guidance into **Clause 6**,
+resulting in 90+ sub-clauses covering security topics. Organizations needed an active ISO 27001
+ISMS to satisfy these requirements.
+
+In 2025, this was rationalized into **29 standalone controls in Table A.3**. These cover the
+same security domains (access control, logging, cryptography, incident management, etc.) but
+are now self-contained and implementable without ISO 27001.
+
+**For organizations holding ISO 27001:2022:** Map your existing ISMS controls to A.3 in the
+PIMS SoA — you are not implementing new controls, just cross-referencing existing evidence.
+
+**For organizations without ISO 27001:** A.3 represents 29 controls that must now be
+independently evidenced. This is the largest new gap for organizations transitioning
+without an ISMS foundation.
+
+### Controller Controls (Annex A → Table A.1)
+
+| 2019 Reference | 2019 Control Name | 2025 Reference |
+|---------------|-------------------|----------------|
+| A.7.2.1 | Identify and document purpose | A.1.2.2 |
+| A.7.2.2 | Identify lawful basis | A.1.2.3 |
+| A.7.2.3 | Determine when and how consent is obtained | A.1.2.4 |
+| A.7.2.4 | Obtain and record consent | A.1.2.5 |
+| A.7.2.5 | Privacy impact assessment | A.1.2.6 |
+| A.7.2.6 | Contracts with PII processors | A.1.2.7 |
+| A.7.2.7 | Joint PII controller | A.1.2.8 |
+| A.7.2.8 | Records related to processing PII | A.1.2.9 |
+| A.7.3.1 | Determining information for PII principals | A.1.3.2, A.1.3.3 |
+| A.7.3.2 | Providing information to PII principals | A.1.3.4 |
+| A.7.3.3 | Mechanism to modify or withdraw consent | A.1.3.5 |
+| A.7.3.4 | Mechanism to object to processing | A.1.3.6 |
+| A.7.3.5 | Access, correction and erasure | A.1.3.7 |
+| A.7.3.6 | Inform third parties | A.1.3.8 |
+| A.7.3.7 | Providing copy of PII | A.1.3.9 |
+| A.7.3.8 | Handling requests | A.1.3.10 |
+| A.7.3.9 | Automated decision making | A.1.3.11 |
+| A.7.4.1 | Limit collection | A.1.4.2 |
+| A.7.4.2 | Limit processing | A.1.4.3 |
+| A.7.4.3 | Accuracy and quality | A.1.4.4 |
+| A.7.4.4 | PII minimization objectives | A.1.4.5 |
+| A.7.4.5 | Temporary files | A.1.4.7 |
+| A.7.5.1 | Basis for PII transfer | A.1.5.2 |
+| A.7.5.2 | Countries for PII transfer | A.1.5.3 |
+| A.7.5.3 | Records of transfer of PII | A.1.5.4 |
+| A.7.5.4 | Records of PII disclosure to third parties | A.1.5.5 |
+| A.7.5.5 | Notification of PII disclosure requests | → moved to A.2.5.5 (processor-focused) |
+| — | New in 2025 | A.1.4.6 De-identification and Deletion |
+| — | New in 2025 | A.1.4.8 Retention |
+| — | New in 2025 | A.1.4.9 Disposal |
+| — | New in 2025 | A.1.4.10 PII Transmission Controls |
+
+### Processor Controls (Annex B → Table A.2)
+
+| 2019 Reference | 2019 Control Name | 2025 Reference |
+|---------------|-------------------|----------------|
+| B.8.2.1 | Customer agreement | A.2.2.2 |
+| B.8.2.2 | Organization's purposes | A.2.2.3 |
+| B.8.2.3 | Marketing and advertising use | A.2.2.4 |
+| B.8.2.4 | Infringing instruction | A.2.2.5 |
+| B.8.2.5 | Customer obligations | A.2.2.6 |
+| B.8.2.6 | Records of processing PII | A.2.2.7 |
+| B.8.3.1 | Obligations to PII principals | A.2.3.2 |
+| B.8.4.1 | Temporary files | A.2.4.2 |
+| B.8.4.2 | Return, transfer or disposal | A.2.4.3 |
+| B.8.5.1 | Basis for PII transfer | A.2.5.2 |
+| B.8.5.2 | Countries for PII transfer | A.2.5.3 |
+| B.8.5.3 | Records of PII disclosures | A.2.5.4 |
+| B.8.5.4 | Notification of PII disclosure requests | A.2.5.5 |
+| B.8.5.5 | Legally binding PII disclosures | A.2.5.6 |
+| B.8.5.6 | Disclosure of subcontractors | A.2.5.7 |
+| — | New in 2025 | A.2.4.4 PII Transmission Controls |
+| — | New in 2025 | A.2.5.8 Engagement of a Subcontractor |
+| — | New in 2025 | A.2.5.9 Change of Subcontractor |
+
+### Security Controls (New: Table A.3)
+
+The 2025 edition introduces **Table A.3** — 29 information security controls drawn
+from ISO 27001/27002:2022 — which all organizations (controllers and processors) must
+address in their SoA regardless of whether they hold ISO 27001 certification.
+
+Organizations that already hold ISO 27001:2022 can reference their existing ISMS
+controls as evidence for the A.3 requirements (the controls are aligned). Organizations
+without ISO 27001 must demonstrate these controls independently.
+
+---
+
+## Gap Analysis for Transition
+
+Run this gap analysis to identify what needs to change for the 2025 transition:
+
+### Phase 1: Clause Structure Gap (Management System)
+
+| Gap Area | 2019 Issue | 2025 Requirement |
+|----------|-----------|-----------------|
+| Own Clause 4–10 | Borrowed from ISO 27001 | PIMS must have own documented clause evidence |
+| PIMS Scope (4.3) | May have been part of ISMS scope | Standalone PIMS scope document required |
+| Privacy Policy (5.2) | May have been embedded in IS Policy | Dedicated privacy policy recommended |
+| Privacy risk assessment (6.1) | Extension of ISMS risk process | PIMS must have documented privacy risk methodology |
+| Standalone SoA (6.1) | Part of ISMS SoA | Standalone PIMS SoA required if not co-located |
+| Internal audit (9.2) | May have been part of ISMS audit | PIMS audit scope must be explicitly defined |
+| Management review (9.3) | Part of ISMS management review | PIMS review inputs/outputs must be explicit |
+
+### Phase 2: Controller Control Gaps (A.1 vs 2019 Annex A)
+
+New controls in A.1 not in 2019 Annex A:
+- **A.1.4.6 De-identification and Deletion** — Is there a documented de-identification and deletion process?
+- **A.1.4.8 Retention** — Are retention schedules defined per data category?
+- **A.1.4.9 Disposal** — Is secure disposal documented and enforced?
+- **A.1.4.10 PII Transmission Controls** — Are controls on PII transmission documented?
+
+### Phase 3: Processor Control Gaps (A.2 vs 2019 Annex B)
+
+New controls in A.2 not in 2019 Annex B:
+- **A.2.4.4 PII Transmission Controls** — Transmission controls at processor level
+- **A.2.5.8 Engagement of a Subcontractor** — Is there a formal authorization process for new sub-processors?
+- **A.2.5.9 Change of Subcontractor** — Is the controller notified in advance of sub-processor changes?
+
+### Phase 4: Security Control Gap (Clause 6 → A.3)
+
+The 2019 Clause 6 contained 90+ sub-clauses drawing from ISO 27001/27002. These are now
+rationalized into 29 discrete controls in Table A.3. This is a restructuring, not wholesale
+new requirements — but organizations must now address A.3 explicitly in their PIMS SoA.
+
+If the organization **holds ISO 27001:2022**:
+- Map existing ISMS controls to the corresponding A.3 controls
+- Document the mapping in the PIMS SoA (e.g., "A.3.25 Logging — fully implemented via
+  ISMS control A.8.15/A.8.16; see evidence reference [SIEM-001]")
+- No new implementation work should be required for existing ISMS holders
+
+If the organization does **not** hold ISO 27001:2022:
+- Review all 29 A.3 controls against current security practices
+- Any gaps must be implemented and evidenced independently
+- This is the single largest new work area for non-ISMS organizations
+
+---
+
+## Transition Audit Steps
+
+Certification bodies will typically require:
+
+1. **Gap analysis** against 2025 requirements (documented)
+2. **Updated PIMS documentation**:
+   - Revised PIMS Scope
+   - Updated or new standalone Privacy Policy
+   - Revised privacy risk assessment to include new controls
+   - New standalone PIMS Statement of Applicability (including A.3)
+   - Updated Records of Processing Activities
+3. **Evidence of new controls**:
+   - Retention schedules and enforcement (A.1.4.8–A.1.4.9)
+   - Sub-processor authorization and notification process (A.2.5.8–A.2.5.9)
+   - A.3 security controls (if not ISO 27001 certified)
+4. **Transition audit** — typically a focused assessment on the gap areas; full
+   recertification not usually required if the gap is well-managed
+5. **Updated SoA** reflecting 2025 control IDs (A.1.x, A.2.x, A.3.x)
+
+---
+
+## Recommended Transition Timeline (for October 2028 Deadline)
+
+| Phase | Target | Actions |
+|-------|--------|---------|
+| Months 1–3 | Gap analysis complete | Run full 2019→2025 gap assessment; produce gap register |
+| Months 3–6 | Documentation updated | Revise scope, policy, risk assessment, SoA |
+| Months 6–12 | New controls implemented | Address A.1.4.6–A.1.4.10, A.2.5.8–A.2.5.9, A.3 controls |
+| Month 12+ | Internal audit | Internal audit against 2025 requirements |
+| Month 18–24 | Transition audit | Engage certification body for transition audit |
+| Before October 2028 | Transition complete | New 2025 certificate issued |
+
+> **Recommendation**: Do not wait until 2027 to begin. Certification bodies will
+> face high demand as the deadline approaches.