|
Work item:
|
X.1058rev
|
|
Subject/title:
|
Information security, cybersecurity and privacy protection - Controls, requirements, and guidance for personally identifiable information protection
|
|
Status:
|
Approved on 2026-02-06 [Issued from previous study period]
|
|
Approval process:
|
TAP
|
|
Type of work item:
|
Recommendation
|
|
Version:
|
Rev.
|
|
Equivalent number:
|
ISO/IEC 29151 (Common)
|
|
Timing:
|
2025-10 (Medium priority)
|
|
Liaison:
|
ISO/IEC JTC 1/SC 27/WG 5
|
|
Supporting members:
|
Korea (Rep. of), Malaysia, South Africa, Soonchunhyang University
|
|
Summary:
|
The number of organizations processing personally identifiable information (PII) is increasing, as is the amount of PII that these organizations deal with. At the same time, societal expectations for the protection of PII and the security of data relating to individuals are also increasing. A number of countries are augmenting their laws to address the increased number of high profile data breaches.
As the number of PII breaches increases, organizations collecting or processing PII will increasingly need guidance on how they should protect PII in order to reduce the risk of privacy breaches occurring, and to reduce the impact of breaches on the organization and on the individuals concerned. This document provides such guidance.
This document specifies controls, purpose, and guidance for implementing controls, to meet the requirements identified by a risk and impact assessment related to the protection of personally identifiable information (PII).
In particular, this document specifies requirements and guidance based on ISO/IEC 27002, taking into consideration the controls for processing PII that can be applicable within the context of an organization's information security risk environment(s).
|
|
Comment:
|
-
|
|
Reference(s):
|
|
|
Historic references:
|
|
Contact(s):
|
|
| ITU-T A.5 justification(s): |
|
|
|
|
First registration in the WP:
2024-03-12 10:03:35
|
|
Last update:
2026-02-12 10:43:46
|
