|
< Previous standard ^ Up a level ^ Next standard >
ISO/IEC 27561 — Information technology — Security techniques — Privacy operationalisation model and method for engineering (POMME) [DRAFT]
Abstract
 “This document describes a model and method to operationalize ISO/IEC 29100 privacy principles into sets of controls and functional capabilities: The method is described as a process following ISO/IEC/IEEE 24774; It is designed for use with other standards and privacy guidance; It supports networked, interdependent applications and systems. The document is intended for engineers and other practitioners developing systems controlling or processing PII.”
[Source: ISO/IEC JTC 1/SC 27 SD11]
Introduction
The standard will present a systematic approach for engineering IT systems to satisfy privacy and personal data protection requirements, drawing on the 11 privacy principles expressed in ISO/IEC 29100 privacy framework and ISO/IEC TR 27555 privacy engineering for system lifecycle processes.
Scope of the standard
The standard will help ‘privacy engineers’ (or system architects or technical managers) interpret and satisfy the privacy requirements expressed in policies etc. plus those that emerge in the course of further analysis and development.
Content of the standard
Foreword, introduction, scope, references, abbreviations, ~50 definitions ...
- Context - background to the model/approach.
- Iterative [personal] information inventory process including determination of the domains, processes, systems and data flows.
- Privacy risk assessment process to determine and document the required controls, functions, mechanisms etc.
- ‘Privacy capabilities’ - essentially the governance arrangements for addressing privacy.
Annexes - relationships to ISO/IEC TR 27550 and ISO/IEC 29100, plus bibliography
Status
The standard is at Draft International Standard stage and is due to be published in 2024.
Personal notes
Despite the contrived title with the neologism ‘operationalization’, the standard’s systematic, structured approach should prove useful for ‘privacy engineers’ seeking direction.
< Previous standard ^ Up a level ^ Next standard >
|
