5.2.1 Understanding the organization and its context
The organization must determine its role as a controller, joint controller or processor, and must determine the external and internal factors bearing on its ability to achieve the intended outcomes of the PIMS, including
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Identity provider / directory
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Contractual requirements bearing on privacy, extracted and recorded · Identity provider / directory
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Documented role determination per processing activity, not merely per organization · Policy repository / GRC workspace
- Register of applicable privacy legislation, regulation and decisions · Policy repository / GRC workspace
- Where both roles are held, separate control sets with the boundary between them documented · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- A single organization wide role declared, when the role changes by processing activity
- Dual role organizations running one blended control set, so processor duties and controller duties are never separately provable
- Context limited to the home jurisdiction while processing crosses borders
- Judicial and supervisory authority decisions omitted from the legal landscape
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.1 General · 5.2.2 Understanding the needs and expectations of interested parties