Month: September 2026

ISO/IEC 27701:2025 Transition: What Organizations Need to Know

Posted on by admin

ISO/IEC 27701 has entered a new phase. Published on 14 October 2025, ISO/IEC 27701:2025 replaces the 2019 edition and transforms the Privacy Information Management System (PIMS) standard from an extension of ISO/IEC 27001 and ISO/IEC 27002 into an independent management system standard.

For organizations currently certified to ISO/IEC 27701:2019, this is not simply an editorial revision. The new edition changes the structure of the standard, strengthens privacy governance and reorganizes requirements and controls for personally identifiable information (PII) controllers and processors.

Under the transition arrangements communicated to QRC-certified clients, organizations holding QRC-issued accredited ISO/IEC 27701:2019 certification must complete their transition to ISO/IEC 27701:2025 by 31 October 2027. After the applicable deadline, accredited certification against the 2019 edition will no longer remain valid.

So, what has changed, and what should certified organizations do now?

What Is ISO/IEC 27701:2025?

ISO/IEC 27701:2025 specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System.

A PIMS helps an organization manage PII systematically by bringing privacy responsibilities, risks, controls, objectives, monitoring and continual improvement into a defined management framework. The standard applies to organizations acting as PII controllers, PII processors or both, regardless of their type, size or sector.

The International Organization for Standardization describes ISO/IEC 27701 as a framework that helps organizations demonstrate accountability, manage risks involving PII and continually improve privacy practices. It can also support an organization’s efforts to address applicable privacy obligations, although certification does not automatically establish compliance with every privacy law.

The Biggest Change: PIMS Is Now a Standalone Standard

ISO/IEC 27701:2019 was designed as an extension to ISO/IEC 27001 and ISO/IEC 27002. In practice, organizations implemented privacy requirements within an existing Information Security Management System (ISMS).

The 2025 edition changes this model. ISO/IEC 27701 can now be implemented and audited as an independent management system standard, without ISO/IEC 27001 certification being a prerequisite.

This makes formal privacy management more accessible to privacy-led organizations that may not require a separately certified ISMS. It also allows PIMS governance to be structured around privacy-specific objectives while retaining the ability to integrate with ISO/IEC 27001 and other management systems.

For organizations already operating an integrated ISMS and PIMS, the change does not mean the systems must be separated. The harmonized structure can support continued integration, provided the organization clearly addresses all applicable requirements and maintains effective governance across both systems.

Key Changes in ISO/IEC 27701:2025

Alignment with the ISO Harmonized Structure

The revised standard follows the familiar management system structure across Clauses 4 to 10:

  • Context of the organization
  • Leadership
  • Planning
  • Support
  • Operation
  • Performance evaluation
  • Improvement

This structure improves alignment with standards such as ISO/IEC 27001, ISO 9001 and ISO/IEC 42001. Organizations operating multiple management systems may therefore find it easier to coordinate common processes such as objectives, competence, internal audits, management reviews, corrective actions and continual improvement.

However, structural familiarity should not be mistaken for automatic conformity. Existing PIMS documentation must be reviewed to ensure privacy-specific requirements are addressed in their new clause locations and supported by suitable evidence.

Stronger Organizational Context and Privacy Governance

The revised structure places privacy within the organization’s broader strategic and operational context. Organizations need to consider the nature of their PII processing, interested parties, applicable legal and regulatory environments, technology dependencies and internal or external factors that may affect privacy outcomes.

Leadership also has a clearer role in ensuring that privacy responsibilities are embedded across relevant functions. Privacy is not solely an IT or compliance concern it can affect product design, marketing, human resources, procurement, legal, customer operations and third-party management.

Updated Controls for PII Controllers and Processors

ISO/IEC 27701:2025 reorganizes the privacy control structure and continues to distinguish between responsibilities applicable to PII controllers and PII processors.

Organizations should revisit how they determine their role for each processing activity. A business may act as a controller in one context and a processor in another, which can change its obligations, contractual responsibilities and applicable controls.

The revised annex structure also provides implementation guidance and mappings that can help organizations understand the relationship between the new and previous editions.

Greater Focus on Privacy Risk

The new edition strengthens the independent treatment of privacy risk within the management system. Risk assessment should consider how PII processing may affect individuals as well as the organization.

This broader perspective is important when evaluating new technologies, automated decision-making, AI-assisted processing, extensive monitoring, large-scale analytics, international operations and complex processor relationships.

Improved Alignment with Other Privacy Frameworks

The revised standard includes mappings to support comparison and integration with recognized privacy references, including the ISO/IEC 29100 Privacy Framework and the EU General Data Protection Regulation. It also provides links to standards relevant to public-cloud PII processing and the protection of PII.

These mappings can assist organizations in understanding relationships between requirements, but they do not replace a legal assessment of the privacy laws applicable to a particular processing activity or jurisdiction.

Who Needs to Transition?

The transition applies to organizations holding accredited ISO/IEC 27701:2019 certification that want to maintain valid accredited PIMS certification beyond the applicable deadline.  It is relevant across sectors, including:

  • Technology and software companies
  • Cloud and managed service providers
  • Financial institutions and fintech organizations
  • Healthcare and life-sciences organizations
  • E-commerce and digital-platform businesses
  • Business process outsourcing providers
  • Government and public-sector entities
  • Organizations processing employee, customer or partner PII at scale

For QRC-certified clients, the transition should be planned within the existing certification cycle so that the required audit and certification activities are completed no later than 31 October 2027.

What Happens If the Transition Is Not Completed?

Organizations that do not complete the transition by the applicable deadline risk losing the validity of their accredited ISO/IEC 27701 certification against the withdrawn 2019 edition.  That outcome may affect contractual commitments, supplier qualification, tenders, customer assurance and public claims linked to certified privacy management. Leaving the transition until the end of the window also creates operational risk: identified gaps may require changes to governance, documentation, controls, training and evidence before conformity can be demonstrated.  Early planning provides time to make controlled improvements and align the transition audit with an upcoming surveillance or recertification activity where feasible.

A Practical ISO/IEC 27701:2025 Transition Roadmap

  1. Review and Scope –  Understand the revised requirements, confirm the certified PIMS scope and identify where the organization acts as a PII controller or processor.
  2. Assess the Gaps –  Compare the existing PIMS with ISO/IEC 27701:2025, covering governance, privacy risks, controls, documented information and supporting evidence.
  3. Implement Required Changes –  Update relevant policies, procedures, risk records, responsibilities and privacy controls. Address emerging risks involving AI, cloud services, third parties and cross-border data transfers.
  4. Validate Readiness –  Build awareness among relevant teams, complete an internal audit and conduct a management review against the revised requirements.
  5. Complete the Transition Audit –  Coordinate the transition audit with QRC within the existing certification cycle, allowing sufficient time to address findings before 31 October 2027.

Common Transition Mistakes to Avoid

Organizations can make the transition more manageable by avoiding a few recurring mistakes :

  • Treating the revision as a clause-renumbering exercise
  • Assuming ISO/IEC 27001 certification automatically demonstrates conformity with the standalone PIMS requirements
  • Failing to reassess controller and processor roles
  • Updating policies without validating operational implementation
  • Overlooking cloud, AI, transfer and third-party processing risks
  • Conducting the internal audit too close to the transition audit
  • Waiting until 2027 to begin planning

The transition should strengthen the PIMS-not merely preserve the certificate.

Questions Leadership Should Ask

Leadership and privacy teams can use the transition to test whether the PIMS remains aligned with the organization’s current risk environment:

  • Can we clearly identify where and why we process PII?
  • Are our controller and processor roles accurate for each significant processing activity?
  • Have changes in technology, AI use, cloud services or international transfers altered our privacy risks?
  • Can process owners demonstrate that documented privacy controls operate effectively?
  • Do our internal audit and management review processes evaluate privacy outcomes, not only procedural completion?
  • Is our transition audit scheduled early enough to address unexpected findings?

If any of these questions are difficult to answer, the organization should prioritize them within its transition plan.

Plan Your ISO/IEC 27701:2025 Transition with QRC

ISO/IEC 27701:2025 gives privacy management a clearer, independent foundation while preserving compatibility with established ISO management systems. Organizations that begin early can use the transition to improve accountability, strengthen privacy-risk governance and demonstrate continued confidence to customers and stakeholders.

QRC Assurance and Solutions is an accredited certification body for ISO/IEC 27701. QRC-certified clients should coordinate their transition audit within the existing certification cycle and complete all applicable transition requirements by 31 October 2027.

Ready to plan your transition to ISO/IEC 27701:2025?

Contact QRC to confirm the certification transition process, expected audit arrangements and suitable scheduling for your organization.

 

Frequently Asked Questions

  1. When was ISO/IEC 27701:2025 published?
    ISO records the publication date of the second edition as 14 October 2025. It replaces the withdrawn ISO/IEC 27701:2019 edition.
  2. What is the ISO/IEC 27701:2025 transition deadline for QRC-certified clients?
    Under the transition arrangements communicated to QRC-certified clients, the transition must be completed by 31 October 2027. Organizations should confirm their individual audit plan and certification-cycle arrangements with QRC.
  3. Is ISO/IEC 27001 still required for ISO/IEC 27701:2025?
    No. ISO/IEC 27701:2025 is an independent management system standard and can be used without ISO/IEC 27001. Organizations may still integrate their PIMS and ISMS where this supports their objectives and operating model.
  4. Can the transition audit be combined with a surveillance or recertification audit?
    Transition activities may be planned within the existing certification cycle, subject to applicable accreditation and certification arrangements. Organizations should coordinate the timing and audit requirements directly with QRC.
  5. Does ISO/IEC 27701 certification prove compliance with privacy laws?
    Certification demonstrates that the organization’s PIMS conforms to the applicable standard requirements within its certified scope. It can support accountability and regulatory-alignment efforts, but it does not automatically prove compliance with every applicable privacy law.

PCI KMO Standard v1.0: What It Means for Payment Security

Posted on by admin

The PCI Security Standards Council (PCI SSC) has published the Payment Card Industry Key Management and Operations (PCI KMO)™ Standard v1.0, introducing a unified framework for organizations that operate and manage systems using cryptographic keys to protect account data.

Published on 14 September 2026, the standard brings key-management security requirements, testing procedures and guidance into a common structure. Its initial focus is on the secure management of PIN and Point-to-Point Encryption (P2PE) keys, while also addressing modern operating models such as cloud-based and remote Hardware Security Modules (HSMs). For financial institutions, payment processors, service providers and organizations supporting cryptographic environments, PCI KMO is more than another security publication. It creates an opportunity to examine whether key-management responsibilities, processes and supporting evidence remain effective across the entire cryptographic key lifecycle.

What Is the PCI KMO Standard?

The PCI KMO Standard defines security and testing requirements for entities involved in operating and managing systems that use cryptographic keys to protect account data.

Its scope follows a key throughout its lifecycle – from secure generation and distribution to storage, use, rotation, replacement, archival where applicable and final destruction. It also considers the procedures, systems, people and equipment involved in managing those keys.

This lifecycle view matters because strong cryptography alone does not guarantee strong security. A secure algorithm can still be undermined by weak access control, unclear custody, poor key-component handling, inadequate monitoring or incomplete destruction records. PCI KMO therefore places the operation of key management within a structured, assessable control environment.

Why Has PCI SSC Introduced KMO?

Key-management requirements have historically existed across different PCI standards and programs. Organizations working with multiple payment-security use cases could consequently encounter overlapping requirements, separate validation activities and different forms of evidence. PCI KMO is intended to become a single source of requirements for key-management operations across relevant PCI programs. The initial release consolidates, aligns and updates requirements related to PIN and P2PE keys and their associated data types.

This structure is designed around an “assess once, use many” approach. Subject to the applicable program rules and scope, one PCI KMO assessment may validate key-management security for both PIN and P2PE key types. An eligible KMO Listing may also be referenced by a PCI P2PE implementation where appropriate.

The practical objective is not simply to reduce duplication. A common framework can help organizations establish clearer ownership, more consistent control implementation and reusable assessment evidence across supported payment environments.

Key Areas Covered by PCI KMO v1.0

  1. The Complete Cryptographic Key Lifecycle

PCI KMO covers the stages through which cryptographic keys pass—from generation to destruction. Organizations should be able to demonstrate that controls remain effective at every stage and that keys cannot be exposed, substituted, misused or retained beyond their authorized purpose.

This requires more than technical configuration. Policies, operating procedures, approval records, access logs, key inventories, custody arrangements and destruction evidence may all contribute to an effective control environment.

  1. PIN and P2PE Key Environments

The initial version focuses on requirements for the secure handling of PIN and P2PE keys and data types. This is particularly relevant for entities that manage key-management services supporting payment acceptance, processing, encryption or PIN-security operations.

Organizations whose environments support both areas should examine whether controls are implemented consistently across teams, systems and locations—and whether their evidence can support the consolidated assessment model.

  1. Cloud-Based and Remote HSMs

Cryptographic infrastructure increasingly extends beyond locally managed hardware. PCI KMO directly addresses cloud-based and remote HSMs, recognizing that key-management operations may depend on shared-responsibility models, remotely administered services and distributed infrastructure.

This makes accountability especially important. Organizations need clarity over who configures the HSM, who administers access, where keys and backups reside, how privileged activities are monitored, how responsibilities are divided between the customer and provider, and what evidence is available for assessment.

  1. Alignment with PCI HSM v5

PCI SSC states that the KMO Standard has been developed in alignment with the recently published PCI HSM v5 requirements. The relationship is significant: HSM requirements address the security capabilities of the device, while KMO focuses on how keys and key-management systems are operated and managed.

A secure device must still be supported by secure procedures, trusted roles, access governance and effective lifecycle controls.

  1. A Modular Framework

PCI KMO is designed to support different key data types and operational models through a modular structure. Its initial application centres on PIN and P2PE, while PCI SSC has indicated that future revisions may address additional needs, including data types covered by the PCI Card Production Standards.

Organizations should therefore treat PCI KMO as an evolving part of the wider PCI ecosystem rather than a one-time compliance exercise.

Who Should Pay Attention to PCI KMO?

The standard is particularly relevant to organizations involved in the management or operation of cryptographic keys used to secure payment account data, including:

  • Financial institutions and payment processors
  • Acquirers, issuers and payment service providers
  • Entities operating PIN-security environments
  • P2PE solution providers and supporting service providers
  • Key-management service providers
  • Organizations using cloud-hosted or remotely managed HSM services
  • Technology providers supporting cryptographic operations
  • Security, compliance, risk and internal-audit teams responsible for payment environments

Applicability should be determined through careful scoping. Simply using encryption does not, by itself, establish the exact PCI KMO assessment obligation. The types of keys handled, services performed, contractual responsibilities, system boundaries and relationships with other PCI programs all need to be understood.

What Should Organizations Do Now?

PCI KMO is new, but organizations do not need to wait before improving readiness. A structured review can begin with the following actions.

  • Identify Relevant Keys and Services –  Build or validate an inventory of cryptographic keys, their purposes, associated data types, custodians, locations, supporting systems and service providers. Map which operations support PIN, P2PE or other payment-security use cases.
  • Review the Entire Key Lifecycle –  Assess how keys are generated, distributed, loaded, stored, used, rotated, revoked and destroyed. Look for stages where ownership is unclear, evidence is incomplete or manual activity creates avoidable risk.
  • Clarify Roles and Segregation of Duties –  Document who can authorize, administer, access and monitor key-management activities. Confirm that sensitive operations use appropriate dual control, split knowledge or other safeguards where required.
  • Examine Cloud and Remote-HSM Responsibilities –  Where third-party or cloud services are involved, review contracts, responsibility matrices, administrative-access models, data-location considerations, incident responsibilities and the availability of assessment evidence.
  • Compare Existing Controls with PCI KMO Requirements –  Organizations already working with PCI PIN or PCI P2PE may have many relevant controls in place. A focused comparison can identify what is reusable, what needs to be aligned and what new evidence or procedures may be required.
  • Monitor the PCI KMO Program –  PCI SSC has released the PCI KMO Requirements and Test Procedures v1.0 and the associated Program Guide. At the time of publication, PCI SSC stated that the KMO Assessor Qualification Requirements were expected soon. Organizations planning a formal assessment should monitor official PCI SSC updates and engage only appropriately qualified KMO assessors when validation is required.

How PCI KMO Can Strengthen Payment-Security Governance

The value of PCI KMO extends beyond assessment efficiency. A consolidated framework can help organizations reduce fragmented ownership of cryptographic controls, improve visibility into key-management dependencies and apply more consistent governance across hybrid infrastructure. It can also encourage better conversations between security, infrastructure, cloud, payment operations, risk, compliance and third-party-management teams. Ask a simple question: Could your organization trace every high-value payment key to its owner, purpose, location, authorized users, last rotation and approved destruction method?

If the answer requires several teams and disconnected records, PCI KMO readiness may be an opportunity to improve the operating model – not merely prepare documentation.

Preparing for PCI KMO with QRC

QRC Assurance And Solutions is a PCI SSC Qualified Security Assessor Company with experience across PCI PIN, PCI P2PE and other PCI security standards. QRC is closely tracking the evolving PCI KMO program and its assessor requirements. Organizations can begin by understanding the applicability of the new standard, identifying relevant cryptographic services and reviewing their existing key-management controls against the published framework.

Is your organization ready to evaluate how PCI KMO v1.0 may affect its payment-security environment?

Connect with QRC to discuss your current cryptographic key-management landscape and identify practical readiness priorities.

Frequently Asked Questions

  1. What does PCI KMO stand for?
    PCI KMO stands for Payment Card Industry Key Management and Operations. It is a PCI SSC standard covering the secure operation and management of systems that use cryptographic keys to protect account data.
  2. Which key types are initially covered by PCI KMO v1.0?
    The initial focus is on the secure handling of PIN and P2PE keys and their related data types. PCI SSC may extend future revisions to address other specific data types and programs.
  3. Does PCI KMO address cloud-based key management?
    Yes. PCI SSC states that the standard directly addresses cloud-based and remote HSMs and aligns with PCI HSM v5 requirements.
  4. Can a single PCI KMO assessment support more than one PCI program?
    PCI KMO is designed around an “assess once, use many” approach. A single assessment may validate security for both PIN and P2PE key types, and an applicable KMO Listing may be referenced by a PCI P2PE implementation where appropriate. Exact use depends on program requirements and confirmed scope.
  5. Is every organization using encryption required to undergo a PCI KMO assessment?
    Not necessarily. Applicability depends on the cryptographic services performed, keys and data types handled, system scope, organizational responsibilities and relevant PCI program requirements. Organizations should conduct a formal scoping review before drawing conclusions.

Official References