A.3.11·critical·Component: Security considerationsWhat this control requires
Plan and prepare for incidents related to PII processing with defined processes, roles and responsibilities. Implementation: Define incident procedures, roles and notification requirements. Justification: Enables timely and effective breach response.
In plain English
Plan and prepare for incidents related to PII processing with defined processes, roles and responsibilities. In practice, this means you can prove you implement incident management planning-level controls on a defined cadence.
Why it matters
ISO 27701 is the international way to evidence the GDPR principle of accountability: certified PIMS controls translate directly into the records, contracts and rights-handling that supervisory authorities want, and into the privacy-engineering evidence SOC 2 + Privacy auditors and enterprise procurement teams ask for.
This control is rated critical in the source catalogue. Treat gaps here as production incidents in the risk register, not housekeeping.
What an auditor looks for
PIMS auditors expect ISO 27001 to be implemented first and then the 27701-additional controls tested. For PII controllers they look at lawful-basis and rights-handling evidence; for PII processors they look at customer-instructions, sub-processor controls and return/transfer/disposal evidence.
Within Security considerations, the assessor will trace your implementation back to the catalogue reference (Annex A A.3.11) and look for objective evidence on the latest two assessment cycles.
How to implement
Incident Response
Runbook. Maintain a runbook keyed by incident type with named roles (IC, comms, scribe), an out-of-band comms channel, and a 72-hour timeline for external notification.
Tabletop. Run a quarterly tabletop exercise (ransomware, insider, supply-chain) and feed gaps back into the runbook.
Operational checklist
- Implement. Document the trigger, the owner and the cadence.
- Define. Document the trigger, the owner and the cadence.
- Process. Document the trigger, the owner and the cadence.
- Scope: incident management planning.
Evidence to collect
- Infra Scan. Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings.
- Ticketing Workflow.
ticketing_workflowevidence - Policy Document. A signed and version-controlled policy / standard / procedure document.
Signed policies, procedures, and registers document the safeguard. Infrastructure posture tooling (AWS/Azure/GCP configuration, encryption, backup, logging) verifies technical enforcement. Service management or request-handling tickets prove timely handling. Focus: Incident management planning.
Common pitfalls
- Runbooks that name a role but no person, or list a paging channel that no longer exists.
How it maps to other frameworks
Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.
- India DPDP Act 2023 IR-001 — Personal Data Breach - DPB Notification
- SOC 2 (2017 TSC) CC7.4 — Incident Response
- NIST SP 800-53 Rev. 5 IR-6 — Incident Reporting
- BSI C5:2020 SIM-01 — Policy for security incident management
Related controls in ISO/IEC 27701:2025
References
- ISO/IEC JTC 1/SC 27 — ISO/IEC 27701:2025
- Catalogue identifier:
Annex A A.3.11
Topics: incident responsedata protectionevent alert