bmad-plus 0.9.0 → 0.9.2

package/src/bmad-plus/packs/pack-shield/references/iso27701/transition-guide.md

@@ -1,219 +1,219 @@
-# ISO 27701:2019 → 2025 Transition Guide
-
-Organizations certified under ISO 27701:2019 have until **October 2028** to transition
-to the 2025 edition. This guide covers the key changes, gap analysis approach, and
-the steps to a successful transition audit.
-
----
-
-## Why the Standard Changed
-
-ISO 27701:2019 was designed as an *extension* to ISO 27001:2013 and ISO 27002:2013.
-When ISO 27001 and ISO 27002 were revised in 2022, ISO 27701 needed realignment.
-Rather than publishing another extension, ISO decided to rebuild ISO 27701 as a
-standalone Privacy Information Management System (PIMS) standard — removing the
-mandatory ISO 27001 prerequisite and making privacy management accessible to
-organizations that may not need or want a full ISMS.
-
----
-
-## Structural Comparison
-
-| Element | 2019 Edition | 2025 Edition |
-|---------|-------------|-------------|
-| Standard type | Extension of ISO 27001:2013 | Standalone PIMS standard |
-| ISO 27001 prerequisite | Mandatory | Optional |
-| HLS framework | Derived from ISO 27001 | Own Clauses 4–10 |
-| Shared security guidance | Clause 6 — 90+ sub-clauses from ISO 27001/27002 | **Table A.3 — 29 rationalized controls** |
-| Controller controls | Annex A (Clause 7) — 28 controls | **Table A.1 — 31 controls** |
-| Processor controls | Annex B (Clause 8) — 16 controls | **Table A.2 — 18 controls** |
-| Annex A purpose | Controller-specific controls | Privacy controls for PII controllers |
-| Annex B purpose | Processor-specific controls | Implementation guidance (new) |
-| Implementation guidance | Minimal inline | **Dedicated Annex B** |
-| GDPR mapping | Annex D | Updated correspondence annex |
-| Control ID format | Clause-based (7.x.x, 8.x.x) | Table-based (A.1.x.x, A.2.x.x, A.3.x) |
-| Cloud/AI/IoT controls | Not explicitly covered | Added to 2025 control set |
-| New controls | — | 3 additional controller; 2 additional processor |
-
----
-
-## Control Mapping: 2019 → 2025
-
-> **Note on 2019 control IDs:** ISO 27701:2019 used clause-based numbering (7.x.x for
-> controllers, 8.x.x for processors). The IDs in the tables below reflect that scheme.
-> For the authoritative, exhaustive control-by-control correspondence, consult
-> **Annex F of ISO 27701:2025** directly — it contains the official mapping table
-> between every 2019 and 2025 control.
-
-### Shared Security Controls (Clause 6 → Table A.3)
-
-In 2019, ISO 27701 incorporated all of ISO 27001/27002's control guidance into **Clause 6**,
-resulting in 90+ sub-clauses covering security topics. Organizations needed an active ISO 27001
-ISMS to satisfy these requirements.
-
-In 2025, this was rationalized into **29 standalone controls in Table A.3**. These cover the
-same security domains (access control, logging, cryptography, incident management, etc.) but
-are now self-contained and implementable without ISO 27001.
-
-**For organizations holding ISO 27001:2022:** Map your existing ISMS controls to A.3 in the
-PIMS SoA — you are not implementing new controls, just cross-referencing existing evidence.
-
-**For organizations without ISO 27001:** A.3 represents 29 controls that must now be
-independently evidenced. This is the largest new gap for organizations transitioning
-without an ISMS foundation.
-
-### Controller Controls (Annex A → Table A.1)
-
-| 2019 Reference | 2019 Control Name | 2025 Reference |
-|---------------|-------------------|----------------|
-| A.7.2.1 | Identify and document purpose | A.1.2.2 |
-| A.7.2.2 | Identify lawful basis | A.1.2.3 |
-| A.7.2.3 | Determine when and how consent is obtained | A.1.2.4 |
-| A.7.2.4 | Obtain and record consent | A.1.2.5 |
-| A.7.2.5 | Privacy impact assessment | A.1.2.6 |
-| A.7.2.6 | Contracts with PII processors | A.1.2.7 |
-| A.7.2.7 | Joint PII controller | A.1.2.8 |
-| A.7.2.8 | Records related to processing PII | A.1.2.9 |
-| A.7.3.1 | Determining information for PII principals | A.1.3.2, A.1.3.3 |
-| A.7.3.2 | Providing information to PII principals | A.1.3.4 |
-| A.7.3.3 | Mechanism to modify or withdraw consent | A.1.3.5 |
-| A.7.3.4 | Mechanism to object to processing | A.1.3.6 |
-| A.7.3.5 | Access, correction and erasure | A.1.3.7 |
-| A.7.3.6 | Inform third parties | A.1.3.8 |
-| A.7.3.7 | Providing copy of PII | A.1.3.9 |
-| A.7.3.8 | Handling requests | A.1.3.10 |
-| A.7.3.9 | Automated decision making | A.1.3.11 |
-| A.7.4.1 | Limit collection | A.1.4.2 |
-| A.7.4.2 | Limit processing | A.1.4.3 |
-| A.7.4.3 | Accuracy and quality | A.1.4.4 |
-| A.7.4.4 | PII minimization objectives | A.1.4.5 |
-| A.7.4.5 | Temporary files | A.1.4.7 |
-| A.7.5.1 | Basis for PII transfer | A.1.5.2 |
-| A.7.5.2 | Countries for PII transfer | A.1.5.3 |
-| A.7.5.3 | Records of transfer of PII | A.1.5.4 |
-| A.7.5.4 | Records of PII disclosure to third parties | A.1.5.5 |
-| A.7.5.5 | Notification of PII disclosure requests | → moved to A.2.5.5 (processor-focused) |
-| — | New in 2025 | A.1.4.6 De-identification and Deletion |
-| — | New in 2025 | A.1.4.8 Retention |
-| — | New in 2025 | A.1.4.9 Disposal |
-| — | New in 2025 | A.1.4.10 PII Transmission Controls |
-
-### Processor Controls (Annex B → Table A.2)
-
-| 2019 Reference | 2019 Control Name | 2025 Reference |
-|---------------|-------------------|----------------|
-| B.8.2.1 | Customer agreement | A.2.2.2 |
-| B.8.2.2 | Organization's purposes | A.2.2.3 |
-| B.8.2.3 | Marketing and advertising use | A.2.2.4 |
-| B.8.2.4 | Infringing instruction | A.2.2.5 |
-| B.8.2.5 | Customer obligations | A.2.2.6 |
-| B.8.2.6 | Records of processing PII | A.2.2.7 |
-| B.8.3.1 | Obligations to PII principals | A.2.3.2 |
-| B.8.4.1 | Temporary files | A.2.4.2 |
-| B.8.4.2 | Return, transfer or disposal | A.2.4.3 |
-| B.8.5.1 | Basis for PII transfer | A.2.5.2 |
-| B.8.5.2 | Countries for PII transfer | A.2.5.3 |
-| B.8.5.3 | Records of PII disclosures | A.2.5.4 |
-| B.8.5.4 | Notification of PII disclosure requests | A.2.5.5 |
-| B.8.5.5 | Legally binding PII disclosures | A.2.5.6 |
-| B.8.5.6 | Disclosure of subcontractors | A.2.5.7 |
-| — | New in 2025 | A.2.4.4 PII Transmission Controls |
-| — | New in 2025 | A.2.5.8 Engagement of a Subcontractor |
-| — | New in 2025 | A.2.5.9 Change of Subcontractor |
-
-### Security Controls (New: Table A.3)
-
-The 2025 edition introduces **Table A.3** — 29 information security controls drawn
-from ISO 27001/27002:2022 — which all organizations (controllers and processors) must
-address in their SoA regardless of whether they hold ISO 27001 certification.
-
-Organizations that already hold ISO 27001:2022 can reference their existing ISMS
-controls as evidence for the A.3 requirements (the controls are aligned). Organizations
-without ISO 27001 must demonstrate these controls independently.
-
----
-
-## Gap Analysis for Transition
-
-Run this gap analysis to identify what needs to change for the 2025 transition:
-
-### Phase 1: Clause Structure Gap (Management System)
-
-| Gap Area | 2019 Issue | 2025 Requirement |
-|----------|-----------|-----------------|
-| Own Clause 4–10 | Borrowed from ISO 27001 | PIMS must have own documented clause evidence |
-| PIMS Scope (4.3) | May have been part of ISMS scope | Standalone PIMS scope document required |
-| Privacy Policy (5.2) | May have been embedded in IS Policy | Dedicated privacy policy recommended |
-| Privacy risk assessment (6.1) | Extension of ISMS risk process | PIMS must have documented privacy risk methodology |
-| Standalone SoA (6.1) | Part of ISMS SoA | Standalone PIMS SoA required if not co-located |
-| Internal audit (9.2) | May have been part of ISMS audit | PIMS audit scope must be explicitly defined |
-| Management review (9.3) | Part of ISMS management review | PIMS review inputs/outputs must be explicit |
-
-### Phase 2: Controller Control Gaps (A.1 vs 2019 Annex A)
-
-New controls in A.1 not in 2019 Annex A:
-- **A.1.4.6 De-identification and Deletion** — Is there a documented de-identification and deletion process?
-- **A.1.4.8 Retention** — Are retention schedules defined per data category?
-- **A.1.4.9 Disposal** — Is secure disposal documented and enforced?
-- **A.1.4.10 PII Transmission Controls** — Are controls on PII transmission documented?
-
-### Phase 3: Processor Control Gaps (A.2 vs 2019 Annex B)
-
-New controls in A.2 not in 2019 Annex B:
-- **A.2.4.4 PII Transmission Controls** — Transmission controls at processor level
-- **A.2.5.8 Engagement of a Subcontractor** — Is there a formal authorization process for new sub-processors?
-- **A.2.5.9 Change of Subcontractor** — Is the controller notified in advance of sub-processor changes?
-
-### Phase 4: Security Control Gap (Clause 6 → A.3)
-
-The 2019 Clause 6 contained 90+ sub-clauses drawing from ISO 27001/27002. These are now
-rationalized into 29 discrete controls in Table A.3. This is a restructuring, not wholesale
-new requirements — but organizations must now address A.3 explicitly in their PIMS SoA.
-
-If the organization **holds ISO 27001:2022**:
-- Map existing ISMS controls to the corresponding A.3 controls
-- Document the mapping in the PIMS SoA (e.g., "A.3.25 Logging — fully implemented via
-  ISMS control A.8.15/A.8.16; see evidence reference [SIEM-001]")
-- No new implementation work should be required for existing ISMS holders
-
-If the organization does **not** hold ISO 27001:2022:
-- Review all 29 A.3 controls against current security practices
-- Any gaps must be implemented and evidenced independently
-- This is the single largest new work area for non-ISMS organizations
-
----
-
-## Transition Audit Steps
-
-Certification bodies will typically require:
-
-1. **Gap analysis** against 2025 requirements (documented)
-2. **Updated PIMS documentation**:
-   - Revised PIMS Scope
-   - Updated or new standalone Privacy Policy
-   - Revised privacy risk assessment to include new controls
-   - New standalone PIMS Statement of Applicability (including A.3)
-   - Updated Records of Processing Activities
-3. **Evidence of new controls**:
-   - Retention schedules and enforcement (A.1.4.8–A.1.4.9)
-   - Sub-processor authorization and notification process (A.2.5.8–A.2.5.9)
-   - A.3 security controls (if not ISO 27001 certified)
-4. **Transition audit** — typically a focused assessment on the gap areas; full
-   recertification not usually required if the gap is well-managed
-5. **Updated SoA** reflecting 2025 control IDs (A.1.x, A.2.x, A.3.x)
-
----
-
-## Recommended Transition Timeline (for October 2028 Deadline)
-
-| Phase | Target | Actions |
-|-------|--------|---------|
-| Months 1–3 | Gap analysis complete | Run full 2019→2025 gap assessment; produce gap register |
-| Months 3–6 | Documentation updated | Revise scope, policy, risk assessment, SoA |
-| Months 6–12 | New controls implemented | Address A.1.4.6–A.1.4.10, A.2.5.8–A.2.5.9, A.3 controls |
-| Month 12+ | Internal audit | Internal audit against 2025 requirements |
-| Month 18–24 | Transition audit | Engage certification body for transition audit |
-| Before October 2028 | Transition complete | New 2025 certificate issued |
-
-> **Recommendation**: Do not wait until 2027 to begin. Certification bodies will
-> face high demand as the deadline approaches.
+# ISO 27701:2019 → 2025 Transition Guide
+
+Organizations certified under ISO 27701:2019 have until **October 2028** to transition
+to the 2025 edition. This guide covers the key changes, gap analysis approach, and
+the steps to a successful transition audit.
+
+---
+
+## Why the Standard Changed
+
+ISO 27701:2019 was designed as an *extension* to ISO 27001:2013 and ISO 27002:2013.
+When ISO 27001 and ISO 27002 were revised in 2022, ISO 27701 needed realignment.
+Rather than publishing another extension, ISO decided to rebuild ISO 27701 as a
+standalone Privacy Information Management System (PIMS) standard — removing the
+mandatory ISO 27001 prerequisite and making privacy management accessible to
+organizations that may not need or want a full ISMS.
+
+---
+
+## Structural Comparison
+
+| Element | 2019 Edition | 2025 Edition |
+|---------|-------------|-------------|
+| Standard type | Extension of ISO 27001:2013 | Standalone PIMS standard |
+| ISO 27001 prerequisite | Mandatory | Optional |
+| HLS framework | Derived from ISO 27001 | Own Clauses 4–10 |
+| Shared security guidance | Clause 6 — 90+ sub-clauses from ISO 27001/27002 | **Table A.3 — 29 rationalized controls** |
+| Controller controls | Annex A (Clause 7) — 28 controls | **Table A.1 — 31 controls** |
+| Processor controls | Annex B (Clause 8) — 16 controls | **Table A.2 — 18 controls** |
+| Annex A purpose | Controller-specific controls | Privacy controls for PII controllers |
+| Annex B purpose | Processor-specific controls | Implementation guidance (new) |
+| Implementation guidance | Minimal inline | **Dedicated Annex B** |
+| GDPR mapping | Annex D | Updated correspondence annex |
+| Control ID format | Clause-based (7.x.x, 8.x.x) | Table-based (A.1.x.x, A.2.x.x, A.3.x) |
+| Cloud/AI/IoT controls | Not explicitly covered | Added to 2025 control set |
+| New controls | — | 3 additional controller; 2 additional processor |
+
+---
+
+## Control Mapping: 2019 → 2025
+
+> **Note on 2019 control IDs:** ISO 27701:2019 used clause-based numbering (7.x.x for
+> controllers, 8.x.x for processors). The IDs in the tables below reflect that scheme.
+> For the authoritative, exhaustive control-by-control correspondence, consult
+> **Annex F of ISO 27701:2025** directly — it contains the official mapping table
+> between every 2019 and 2025 control.
+
+### Shared Security Controls (Clause 6 → Table A.3)
+
+In 2019, ISO 27701 incorporated all of ISO 27001/27002's control guidance into **Clause 6**,
+resulting in 90+ sub-clauses covering security topics. Organizations needed an active ISO 27001
+ISMS to satisfy these requirements.
+
+In 2025, this was rationalized into **29 standalone controls in Table A.3**. These cover the
+same security domains (access control, logging, cryptography, incident management, etc.) but
+are now self-contained and implementable without ISO 27001.
+
+**For organizations holding ISO 27001:2022:** Map your existing ISMS controls to A.3 in the
+PIMS SoA — you are not implementing new controls, just cross-referencing existing evidence.
+
+**For organizations without ISO 27001:** A.3 represents 29 controls that must now be
+independently evidenced. This is the largest new gap for organizations transitioning
+without an ISMS foundation.
+
+### Controller Controls (Annex A → Table A.1)
+
+| 2019 Reference | 2019 Control Name | 2025 Reference |
+|---------------|-------------------|----------------|
+| A.7.2.1 | Identify and document purpose | A.1.2.2 |
+| A.7.2.2 | Identify lawful basis | A.1.2.3 |
+| A.7.2.3 | Determine when and how consent is obtained | A.1.2.4 |
+| A.7.2.4 | Obtain and record consent | A.1.2.5 |
+| A.7.2.5 | Privacy impact assessment | A.1.2.6 |
+| A.7.2.6 | Contracts with PII processors | A.1.2.7 |
+| A.7.2.7 | Joint PII controller | A.1.2.8 |
+| A.7.2.8 | Records related to processing PII | A.1.2.9 |
+| A.7.3.1 | Determining information for PII principals | A.1.3.2, A.1.3.3 |
+| A.7.3.2 | Providing information to PII principals | A.1.3.4 |
+| A.7.3.3 | Mechanism to modify or withdraw consent | A.1.3.5 |
+| A.7.3.4 | Mechanism to object to processing | A.1.3.6 |
+| A.7.3.5 | Access, correction and erasure | A.1.3.7 |
+| A.7.3.6 | Inform third parties | A.1.3.8 |
+| A.7.3.7 | Providing copy of PII | A.1.3.9 |
+| A.7.3.8 | Handling requests | A.1.3.10 |
+| A.7.3.9 | Automated decision making | A.1.3.11 |
+| A.7.4.1 | Limit collection | A.1.4.2 |
+| A.7.4.2 | Limit processing | A.1.4.3 |
+| A.7.4.3 | Accuracy and quality | A.1.4.4 |
+| A.7.4.4 | PII minimization objectives | A.1.4.5 |
+| A.7.4.5 | Temporary files | A.1.4.7 |
+| A.7.5.1 | Basis for PII transfer | A.1.5.2 |
+| A.7.5.2 | Countries for PII transfer | A.1.5.3 |
+| A.7.5.3 | Records of transfer of PII | A.1.5.4 |
+| A.7.5.4 | Records of PII disclosure to third parties | A.1.5.5 |
+| A.7.5.5 | Notification of PII disclosure requests | → moved to A.2.5.5 (processor-focused) |
+| — | New in 2025 | A.1.4.6 De-identification and Deletion |
+| — | New in 2025 | A.1.4.8 Retention |
+| — | New in 2025 | A.1.4.9 Disposal |
+| — | New in 2025 | A.1.4.10 PII Transmission Controls |
+
+### Processor Controls (Annex B → Table A.2)
+
+| 2019 Reference | 2019 Control Name | 2025 Reference |
+|---------------|-------------------|----------------|
+| B.8.2.1 | Customer agreement | A.2.2.2 |
+| B.8.2.2 | Organization's purposes | A.2.2.3 |
+| B.8.2.3 | Marketing and advertising use | A.2.2.4 |
+| B.8.2.4 | Infringing instruction | A.2.2.5 |
+| B.8.2.5 | Customer obligations | A.2.2.6 |
+| B.8.2.6 | Records of processing PII | A.2.2.7 |
+| B.8.3.1 | Obligations to PII principals | A.2.3.2 |
+| B.8.4.1 | Temporary files | A.2.4.2 |
+| B.8.4.2 | Return, transfer or disposal | A.2.4.3 |
+| B.8.5.1 | Basis for PII transfer | A.2.5.2 |
+| B.8.5.2 | Countries for PII transfer | A.2.5.3 |
+| B.8.5.3 | Records of PII disclosures | A.2.5.4 |
+| B.8.5.4 | Notification of PII disclosure requests | A.2.5.5 |
+| B.8.5.5 | Legally binding PII disclosures | A.2.5.6 |
+| B.8.5.6 | Disclosure of subcontractors | A.2.5.7 |
+| — | New in 2025 | A.2.4.4 PII Transmission Controls |
+| — | New in 2025 | A.2.5.8 Engagement of a Subcontractor |
+| — | New in 2025 | A.2.5.9 Change of Subcontractor |
+
+### Security Controls (New: Table A.3)
+
+The 2025 edition introduces **Table A.3** — 29 information security controls drawn
+from ISO 27001/27002:2022 — which all organizations (controllers and processors) must
+address in their SoA regardless of whether they hold ISO 27001 certification.
+
+Organizations that already hold ISO 27001:2022 can reference their existing ISMS
+controls as evidence for the A.3 requirements (the controls are aligned). Organizations
+without ISO 27001 must demonstrate these controls independently.
+
+---
+
+## Gap Analysis for Transition
+
+Run this gap analysis to identify what needs to change for the 2025 transition:
+
+### Phase 1: Clause Structure Gap (Management System)
+
+| Gap Area | 2019 Issue | 2025 Requirement |
+|----------|-----------|-----------------|
+| Own Clause 4–10 | Borrowed from ISO 27001 | PIMS must have own documented clause evidence |
+| PIMS Scope (4.3) | May have been part of ISMS scope | Standalone PIMS scope document required |
+| Privacy Policy (5.2) | May have been embedded in IS Policy | Dedicated privacy policy recommended |
+| Privacy risk assessment (6.1) | Extension of ISMS risk process | PIMS must have documented privacy risk methodology |
+| Standalone SoA (6.1) | Part of ISMS SoA | Standalone PIMS SoA required if not co-located |
+| Internal audit (9.2) | May have been part of ISMS audit | PIMS audit scope must be explicitly defined |
+| Management review (9.3) | Part of ISMS management review | PIMS review inputs/outputs must be explicit |
+
+### Phase 2: Controller Control Gaps (A.1 vs 2019 Annex A)
+
+New controls in A.1 not in 2019 Annex A:
+- **A.1.4.6 De-identification and Deletion** — Is there a documented de-identification and deletion process?
+- **A.1.4.8 Retention** — Are retention schedules defined per data category?
+- **A.1.4.9 Disposal** — Is secure disposal documented and enforced?
+- **A.1.4.10 PII Transmission Controls** — Are controls on PII transmission documented?
+
+### Phase 3: Processor Control Gaps (A.2 vs 2019 Annex B)
+
+New controls in A.2 not in 2019 Annex B:
+- **A.2.4.4 PII Transmission Controls** — Transmission controls at processor level
+- **A.2.5.8 Engagement of a Subcontractor** — Is there a formal authorization process for new sub-processors?
+- **A.2.5.9 Change of Subcontractor** — Is the controller notified in advance of sub-processor changes?
+
+### Phase 4: Security Control Gap (Clause 6 → A.3)
+
+The 2019 Clause 6 contained 90+ sub-clauses drawing from ISO 27001/27002. These are now
+rationalized into 29 discrete controls in Table A.3. This is a restructuring, not wholesale
+new requirements — but organizations must now address A.3 explicitly in their PIMS SoA.
+
+If the organization **holds ISO 27001:2022**:
+- Map existing ISMS controls to the corresponding A.3 controls
+- Document the mapping in the PIMS SoA (e.g., "A.3.25 Logging — fully implemented via
+  ISMS control A.8.15/A.8.16; see evidence reference [SIEM-001]")
+- No new implementation work should be required for existing ISMS holders
+
+If the organization does **not** hold ISO 27001:2022:
+- Review all 29 A.3 controls against current security practices
+- Any gaps must be implemented and evidenced independently
+- This is the single largest new work area for non-ISMS organizations
+
+---
+
+## Transition Audit Steps
+
+Certification bodies will typically require:
+
+1. **Gap analysis** against 2025 requirements (documented)
+2. **Updated PIMS documentation**:
+   - Revised PIMS Scope
+   - Updated or new standalone Privacy Policy
+   - Revised privacy risk assessment to include new controls
+   - New standalone PIMS Statement of Applicability (including A.3)
+   - Updated Records of Processing Activities
+3. **Evidence of new controls**:
+   - Retention schedules and enforcement (A.1.4.8–A.1.4.9)
+   - Sub-processor authorization and notification process (A.2.5.8–A.2.5.9)
+   - A.3 security controls (if not ISO 27001 certified)
+4. **Transition audit** — typically a focused assessment on the gap areas; full
+   recertification not usually required if the gap is well-managed
+5. **Updated SoA** reflecting 2025 control IDs (A.1.x, A.2.x, A.3.x)
+
+---
+
+## Recommended Transition Timeline (for October 2028 Deadline)
+
+| Phase | Target | Actions |
+|-------|--------|---------|
+| Months 1–3 | Gap analysis complete | Run full 2019→2025 gap assessment; produce gap register |
+| Months 3–6 | Documentation updated | Revise scope, policy, risk assessment, SoA |
+| Months 6–12 | New controls implemented | Address A.1.4.6–A.1.4.10, A.2.5.8–A.2.5.9, A.3 controls |
+| Month 12+ | Internal audit | Internal audit against 2025 requirements |
+| Month 18–24 | Transition audit | Engage certification body for transition audit |
+| Before October 2028 | Transition complete | New 2025 certificate issued |
+
+> **Recommendation**: Do not wait until 2027 to begin. Certification bodies will
+> face high demand as the deadline approaches.