The Plan-Do-Check-Act (PDCA) model is a process-oriented approach for continuous improvement of business processes. It is credited to W. Edwards Demming. Its intention is the improvment of processes or the removal of problems as part of an interative process that includes planning, assessment, implementation and evaluation. Figure 1 below shows the four stages Plan, Do, Check, Act as a cyclus that starts with the planning phase.

Figure 1: The PDCA cycle.

PDCA is the framework of many IT management standards. The ISO 2700x family of standards for information security management is an implementation of PDCA that is very relevant for privacy management. Figure 2 below shows the activities of security management mapped to the phases of PDCA.

In the Plan phase, the business objectives are identified. Management support is obtained, the scope of the ISMS is defined. Risk analysis methods are chosen, and an appropriate inventory of assets at risk with ranked risk assessments is produced.
The Do phase manages the risks by generating a treatment plan for the risks, by allocating budgets, training staff and by the creation of policies.
The Check phase monitors the implementaiton of the security management activities, and possibly prepares for the certification of its results.
The Act phase carries our re-assessment audits that evaluate the overall outcome of the corrective actions and the initiates a new round of the cycle with corrective input, if necessary.

Figure 2: PDCA cycle for ISO 27000 Information Security Management System (ISMS).
From “Planning for and Implementing ISO 27001” by Charu Pelnakar, ISACA Journal, Vol. 4, 2011.

If the first iteration of a PDCA cycle does not remove the risks in satisfactory ways - or if new assessments should introduce new risks - then the cycle will be re-run again and again, until the major security issues are resolved in satisfactory ways. Figure three shows three iterations of PDCA that finally in the 3rd iteration resolved the problem:

Figure 3: Multiple iterations of the PDCA cycle are repeated until the problem is solved. Source Christoph Roser at AllAboutLean.com

A ISMS in compliance with ISO27001 will require very detailed preparation, and will need in addition dedicated staff resources. In Figure 4 below, you can see a detailed view of an ISMS. A full ISMS is therefore often feasible for large organizations with both coporate IT policies, training and professional information security managers. An existing ISMS can be used as a framework for the integration of privacy management by introducing privacy risk assessment elements, personal data assets and corrective actions for privacy and data protection into the existing ISMS. However there will arise a need for more staff trained for privacy management.

Figure 4: Detailed sketch of an ISO27001 ISMS.

If you consider the integration of privacy management into your existing ISMS, the article "Mapping between GDPR (the EU General Data Protection Regulation) and ISO27k" published by the ISO27k forum will be helpful to you.It lists overlaps and similarities between GDPR requirements and ISO2700x security management. The document even suggests relevant ISO 27001 controls for managing privacy.

You will learn more on privacy controls in part 5 of this lecture.

References

http://www.iso27001security.com/
“Planning for and Implementing ISO 27001” by Charu Pelnakar, ISACA Journal, Vol. 4, 2011
Mapping between GDPR (the EU General Data Protection Regulation) and ISO27k, Iso27k forum, November 2016 [link]

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.