Who it is for
A proportionate engagement with clear boundaries.
Organisations preparing a PIMS for independent assessment or seeking a clear baseline before implementation work continues.
Advisory & readiness
ISO/IEC 27701 certification readiness
A structured review of PIMS scope, privacy governance, processing evidence and operational readiness for ISO/IEC 27701:2025.
ISMS operating modelFrom policy to practice
Acceptance and competence boundary
Acceptance is subject to a documented review of privacy-management competence, capacity, processing context, relevant jurisdictions and any need for legal or specialist input. Mang Morgan does not provide legal advice; an engagement may require an approved specialist or be declined if the required competence or independence cannot be demonstrated.
What is included
- Scope and PII-role review
- Privacy governance and accountability review
- Processing-record and evidence-readiness assessment
- Selected privacy-process walkthroughs
- Prioritised readiness analysis
Typical outputs
- PIMS readiness assessment
- Evidence action list
- Prioritised improvement roadmap
- Leadership briefing
What we need from you
- Proposed PIMS scope
- PII processing inventory and data flows
- Privacy risk and obligation records
- Available policies, procedures and evidence
Timing
Confirmed after the number of processing activities, roles, jurisdictions, stakeholders and evidence maturity are scoped.
Pricing basis
Usually fixed-fee when the PIMS boundary, processing inventory, interview plan and evidence set are sufficiently defined.
Important exclusions
- A formal internal-audit opinion unless separately scoped
- Certification
- Legal advice
- Implementation of identified actions
Frequently asked questions
Does this service result in certification?
No. Mang Morgan does not issue ISO/IEC 27001 or ISO/IEC 27701 certificates or guarantee a certification outcome. A certification decision remains outside this engagement.
How is the scope confirmed?
We confirm the intended outcome, management-system boundary, criteria, locations, processing context, evidence, stakeholders, dates and limitations before issuing the final proposal.
Can the work use a client platform?
We can work in authorised client-owned GRC or privacy-management platforms where appropriate. Platform status helps organise evidence but does not replace testing or professional judgement, and platform experience does not imply partnership.
What happens if the scope changes?
Additional sites, products, processing activities, jurisdictions, frameworks, interviews, revisions, travel, remediation or accelerated dates are assessed through agreed change control.
Start with a defined scope
A clear plan. An agreed fee.
Tell us your objectives and timing. Your proposal will set out the work, deliverables and responsibilities.