# ISO/IEC 27001:2022 A.5.34 — Privacy and protection of personal identifiable information (PII) - Source: https://support.icompaas.com/compliance/iso-27001-2022/a-5-34-privacy-and-protection-of-personal-identifiable-information-pii - Section: [Compliance](https://support.icompaas.com/compliance) › [ISO/IEC 27001:2022 Annex A Controls](https://support.icompaas.com/compliance/iso-27001-2022) › Organizational controls - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **ISO/IEC 27001:2022**·Annex A `A.5.34`·high·Component: **Organizational controls** ## What this control requires > The organization shall identify and meet the requirements regarding the preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements. > > — ISO/IEC 27001:2022, Annex A A.5.34 ### In plain English The organization shall identify and meet the requirements regarding the preservation of privacy and protection of PII according to applicable laws and regulations and contractual requirements. In practice, this means you can prove you information information-level controls on a defined cadence. ## Why it matters ISO 27001 certification depends on showing each Annex A control is either implemented or explicitly justified for exclusion in the Statement of Applicability (SoA). Certification bodies sample controls during surveillance audits, and a missing SoA entry — or implementation that doesn't match the SoA wording — is a finding. This control is rated **high**. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation. ## What an auditor looks for An ISO 27001 lead auditor looks for: (1) an SoA entry covering the control with justification, (2) a documented procedure or policy implementing it, (3) records that prove the procedure runs (logs, tickets, training records) and (4) management-review evidence that effectiveness is monitored. Within **Organizational controls**, the assessor will trace your implementation back to the catalogue reference (Annex A A.5.34) and look for objective evidence on the latest two assessment cycles. ## How to implement #### Cloud Posture **CSPM.** Run Wiz / Prisma / Defender for Cloud / Security Command Center over every account; auto-ticket findings above your accepted-risk threshold. #### Configuration Management **Policy-as-code.** Codify the control as Service Control Policies (AWS), Azure Policy initiatives, or Organisation Policy (GCP) so the platform enforces what the document promises. **IaC.** Gate Terraform / Pulumi / CloudFormation changes with Checkov / tfsec / OPA so misconfigurations never reach production. **Drift.** Run a CSPM (Wiz / Prisma / Defender for Cloud / Security Command Center) over every account and route findings to a single risk register. #### Network Security **AWS.** VPC Flow Logs to S3, default-deny security groups, AWS Network Firewall for north-south, and Transit Gateway for hub-and-spoke segmentation. **Azure.** NSGs with deny-by-default, Azure Firewall Premium with TLS inspection, Private Endpoints for PaaS, and Microsoft Defender for Cloud's secure score for drift. **GCP.** VPC Service Controls perimeters around sensitive APIs, Cloud NGFW Enterprise for L7 inspection, Private Service Connect for managed services. ### Operational checklist - **Information.** Document the trigger, the owner and the cadence. - **Management.** Document the trigger, the owner and the cadence. - **Protection.** Document the trigger, the owner and the cadence. - **Privacy.** Document the trigger, the owner and the cadence. - **Security.** Document the trigger, the owner and the cadence. - **Scope:** information, management, security. ## Evidence to collect - **Infra Scan.** Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings. Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Privacy and protection of personal identifiable information (PII). ## Common pitfalls - Treating CSPM findings as a backlog instead of a hot queue: findings older than the policy SLA accumulate until the auditor asks why. - Manual cloud-console changes that never make it back to Terraform — drift accumulates until the next outage forces a reconciliation. - Default-allow egress rules; East-West traffic with no segmentation; jump hosts on the public internet with password auth. ## How it maps to other frameworks Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit. - [**BSI C5:2020 INQ-02** — INQ-02 Informing Cloud Customers about Investigation Requests](https://support.icompaas.com/compliance/bsi-c5-2020/inq-02-inq-02-informing-cloud-customers-about-investigation-requests) - [**NIST SP 800-171 Rev. 3 3.13.6** — Network Communications - Deny by Default - Allow by Exception](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-6-network-communications-deny-by-default-allow-by-exception) - [**NIST SP 800-53 Rev. 5 PL-10** — Baseline Selection](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/pl-10-baseline-selection) - [**CIS Controls v8 16.14** — Conduct Threat Modeling](https://support.icompaas.com/compliance/cis-controls-v8/16-14-conduct-threat-modeling) - [**GDPR Article 52** — Independence](https://support.icompaas.com/compliance/gdpr/article-52-independence) ## Related controls in ISO/IEC 27001:2022 - [**Annex A A.8.22** — Segregation of networks](https://support.icompaas.com/compliance/iso-27001-2022/a-8-22-segregation-of-networks) - [**Annex A A.5.23** — Information security for use of cloud services](https://support.icompaas.com/compliance/iso-27001-2022/a-5-23-information-security-for-use-of-cloud-services) - [**Annex A A.5.1** — Policies for information security](https://support.icompaas.com/compliance/iso-27001-2022/a-5-1-policies-for-information-security) - [**Annex A A.5.4** — Management responsibilities](https://support.icompaas.com/compliance/iso-27001-2022/a-5-4-management-responsibilities) - [**Annex A A.5.12** — Classification of information](https://support.icompaas.com/compliance/iso-27001-2022/a-5-12-classification-of-information) - [**Annex A A.5.29** — Information security during disruption](https://support.icompaas.com/compliance/iso-27001-2022/a-5-29-information-security-during-disruption) ## References - [ISO/IEC JTC 1/SC 27 — ISO/IEC 27001:2022](https://www.iso.org/standard/27001) - Catalogue identifier: `Annex A A.5.34` Topics: cloud infrastructurecloud postureprivacy managementconfiguration managementnetwork security ## Related compliance guidance - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): Start with the full ISO 27001 implementation guide — scope, roadmap, evidence and how the assessment runs. - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most companies that hold ISO 27001 also need a SOC 2 report for North American customers, and the two share most of their technical controls.