ISO/IEC 27701:2025·Annex A A.3.29·high·Component: Security considerations

What this control requires

Establish principles for engineering secure systems processing PII. Implementation: Document engineering principles and apply to new systems/projects. Justification: Systems designed with privacy-by-design facilitate control implementation.
— ISO/IEC 27701:2025, Annex A A.3.29

In plain English

Establish principles for engineering secure systems processing PII. In practice, this means you can prove you implement secure system architecture-level controls on a defined cadence.

Why it matters

ISO 27701 is the international way to evidence the GDPR principle of accountability: certified PIMS controls translate directly into the records, contracts and rights-handling that supervisory authorities want, and into the privacy-engineering evidence SOC 2 + Privacy auditors and enterprise procurement teams ask for.

This control is rated high. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation.

What an auditor looks for

PIMS auditors expect ISO 27001 to be implemented first and then the 27701-additional controls tested. For PII controllers they look at lawful-basis and rights-handling evidence; for PII processors they look at customer-instructions, sub-processor controls and return/transfer/disposal evidence.

Within Security considerations, the assessor will trace your implementation back to the catalogue reference (Annex A A.3.29) and look for objective evidence on the latest two assessment cycles.

How to implement

Network Security

AWS. VPC Flow Logs to S3, default-deny security groups, AWS Network Firewall for north-south, and Transit Gateway for hub-and-spoke segmentation.

Azure. NSGs with deny-by-default, Azure Firewall Premium with TLS inspection, Private Endpoints for PaaS, and Microsoft Defender for Cloud's secure score for drift.

GCP. VPC Service Controls perimeters around sensitive APIs, Cloud NGFW Enterprise for L7 inspection, Private Service Connect for managed services.

Operational checklist

  • Implement. Document the trigger, the owner and the cadence.
  • Document. Document the trigger, the owner and the cadence.
  • Process. Document the trigger, the owner and the cadence.
  • Scope: secure system architecture.

Evidence to collect

  • Infra Scan. Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings.
  • Policy Document. A signed and version-controlled policy / standard / procedure document.

Signed policies, procedures, and registers document the safeguard. Infrastructure posture tooling (AWS/Azure/GCP configuration, encryption, backup, logging) verifies technical enforcement. Focus: Secure system architecture.

Common pitfalls

  • Default-allow egress rules; East-West traffic with no segmentation; jump hosts on the public internet with password auth.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

References

Topics: network securityapplication securitynetwork segmentationfirewall management