ISO/IEC 27561
ISO/IEC 27561:2024 — Information security, cybersecurity and privacy protection — Privacy operationalisation model and method for engineering (POMME)
(first edition)
Abstract
“This guidance document [ISO/IEC 27561] describes a model and method to operationalize the privacy principles specified in ISO/IEC 29100 into sets of controls and functional capabilities. The method is described as a process that builds upon ISO/IEC/IEEE 24774. [ISO/IEC 27561] is designed for use in conjunction with relevant privacy and security standards and guidance which impact privacy operationalization. It supports networked, interdependent applications and systems. [ISO/IEC 27561] is intended for engineers and other practitioners developing systems controlling or processing personally identifiable information.”
[Source: ISO/IEC 27561:2024]
Introduction
The standard presents a systematic approach for engineering IT systems to satisfy privacy and personal data protection requirements, drawing on the 11 privacy principles expressed in ISO/IEC 29100 privacy framework plus ISO/IEC TR 27550 and ISO/IEC TR 27555 privacy engineering for system lifecycle processes.
Scope
The standard is intended to help ‘privacy engineers’ (or system architects or technical managers) interpret and satisfy the privacy requirements expressed in policies etc. plus those that emerge in the course of further analysis and development. It lays out a structured analytical method and model based on OASIS, emphasising functional architecture and practical implementation of privacy engineering. The process involves elaborating on privacy risks and designing controls, capabilities required plus the functions and mechanisms to deliver them.
Structure
Main sections:
5: Context of privacy operationalization - background to the model and approach.
6: Initial information inventory process - an iterative personal information inventory process including determination of the domains, processes, systems and data flows.
7: Privacy controls, privacy control requirements, capabilities, risk assessment and iteration process - determination and documentation of the required controls, functions, mechanisms etc.
8: Privacy capabilities - essentially the governance arrangements for addressing privacy.
Annex A: Mapping of the privacy principles from ISO/IEC 29100 to POMME capabilities.
Annex B: Lifecycle process example involving a PII controller and a solution provider.
Annex C: POMME capability functions and mechanisms in a consumer application use case.
Status
The current first edition was published in 2024.
Commentary
Despite the contrived title and nasty neologism ‘operationalization’, the standard’s systematic, structured approach should prove useful for privacy specialists.