ISO 27001 gap analysis for China CSL DSL PIPL compliance: what certification misses
Amara OkaforApril 29, 2026
Key takeaways
ISO 27001 certification addresses information security management system documentation. China's CSL, DSL, and PIPL impose specific technical obligations, including data localisation, cross-border transfer approval mechanisms, and consent standards, that ISO 27001 Annex A controls do not map to directly.
The most common finding in ISO 27001-certified organisations operating in China is SIEM and analytics platform data flows that route Chinese personal information to servers outside China, violating DSL and PIPL localisation requirements without the organisation being aware.
PIPL cross-border transfer requires one of three approved mechanisms: standard contract, security assessment by the CAC, or certification by a CAC-approved institution. ISO 27001 data transfer controls (A.5.10) do not satisfy any of these three mechanisms.
Data classification under China's DSL requires a national standard-aligned tiered system covering important data and core data categories. ISO 27001 risk assessment-driven classification does not produce a DSL-compliant classification scheme, and the gap creates regulatory exposure for organisations that assume it does.
CAC enforcement actions following PIPL breaches examine consent collection mechanisms, data subject rights implementation, and cross-border transfer documentation. ISO 27001 surveillance audit findings examine ISMS documentation, management review evidence, and risk treatment plan currency. These are different evidence sets.
TL;DR
ISO 27001 is a process standard for managing information security. China's CSL, DSL, and PIPL are regulatory instruments with specific technical obligations that exist independently of any management framework. The mistake is assuming that satisfying one satisfies the others. It does not. The gap analysis that surfaces the difference focuses on three areas: data localisation verification, cross-border transfer mechanism compliance, and PIPL consent implementation. All three are technically verifiable. None are addressed by ISO 27001 certification.
The CAC notice that arrived after the ISO 27001 audit passed
A European software company operating in China held current ISO 27001 certification covering its China operations. The certification was genuine, the scope was relevant, and the most recent surveillance audit had cleared with two minor nonconformities, both resolved. The compliance team considered the China security posture sound.
A Cyberspace Administration of China inquiry arrived six months later. The subject: cross-border transfer of personal information without completion of the required security assessment. The mechanism: the company's cloud SIEM, deployed for unified global security monitoring, was ingesting logs from China-based servers and routing them to a European data centre for analysis. The logs contained IP addresses, user identifiers, and behavioural data for Chinese users. Under PIPL Article 38, this constituted a cross-border transfer of personal information requiring either a CAC security assessment, a standard contract filed with the CAC, or certification by an approved institution.
None of those mechanisms were in place. The ISO 27001 certification covered the SIEM as a security control. It did not evaluate whether the SIEM's data flows complied with PIPL cross-border transfer requirements.
This is the specific gap that ISO 27001 certification does not close: the framework addresses whether security controls are documented and managed. Chinese regulatory requirements address what data can flow where, under what mechanism, with what consent. Those are different questions. The certification answers the first. It says nothing about the second.
Why ISO 27001 Annex A does not map to China regulatory requirements
ISO 27001:2022 Annex A contains 93 controls across four domains: Organisational, People, Physical, and Technological. The controls address information security risk management. They are not designed to address jurisdiction-specific regulatory obligations. The Statement of Applicability process requires organisations to document which controls apply to their risk context. Nothing in the SoA process requires mapping to specific regulatory requirements of the jurisdictions in which the organisation operates.
China's three primary data regulations each impose obligations that have no direct Annex A counterpart. CSL Critical Information Infrastructure (CII) designation triggers sector-specific security requirements and mandatory data localisation for CII operators. DSL requires a national standard-aligned data classification system covering important data and core data categories, with different obligations attaching to each tier. PIPL imposes consent requirements for personal information processing, specific mechanisms for cross-border transfer, and data subject rights including deletion, correction, and portability, all with defined response timelines.
An ISO 27001-certified organisation has documented security controls against its risk assessment. It may or may not have mapped those controls to the specific technical requirements of CSL, DSL, and PIPL. The certification does not require that mapping. The CAC does not accept the certification as evidence of regulatory compliance. These are parallel tracks that intersect in some areas and diverge in others.
Example
A.5.10 in ISO 27001:2022 covers acceptable use of information and other associated assets, including transfer restrictions. Implementing A.5.10 means documenting acceptable use policies and transfer restrictions. PIPL Article 38 cross-border transfer compliance requires one of: completion of a CAC security assessment (mandatory for Critical Information Infrastructure operators and organisations transferring personal information above defined volume thresholds), execution of a standard contract in the form prescribed by the CAC and filed with the local CAC office, or certification by a CAC-approved institution. A.5.10 implementation does not produce any of these three mechanisms. An organisation that treats A.5.10 as its PIPL cross-border transfer control has a documented acceptable use policy and a regulatory gap.
The PIPL standard contract mechanism requires specific procedural steps that are easy to miss: the standard contract must use the CAC-prescribed template without material modification, must be executed before the transfer begins, and must be filed with the local CAC within 10 working days of execution. Organisations that execute a standard contract but fail to file it have not completed the mechanism. CAC enforcement actions have targeted the filing step specifically, because it is the step that creates a regulatory record of the transfer. ISO 27001 audit evidence does not include CAC filing confirmation. It would not flag the gap.
Technical control gaps found in ISO 27001-certified organisations with China operations
Assessment base: Vulnox assessment data, organisations with China operations and ISO 27001 certification, 2023 to 2025
SIEM and security tooling data flows routing Chinese personal information outside China
In assessed organisations with ISO 27001 certification covering China operations, the most consistent finding is security and operational tooling that routes data containing Chinese personal information to non-China infrastructure. The sources: SIEM log ingestion pipelines, cloud-native monitoring services, application performance monitoring, and analytics platforms. These tools are selected and deployed by security and engineering teams for legitimate operational reasons. Their data flows are not evaluated against PIPL cross-border transfer requirements during deployment. The ISO 27001 certification covers the tools as security controls. It does not cover their data flows as regulatory compliance objects.
Every log shipped from a China-based server to a non-China SIEM instance that contains personal information is a PIPL Article 38 cross-border transfer. This includes IP addresses associated with user accounts, session identifiers, user behaviour logs, and any other data that can identify a natural person directly or indirectly. Organisations running unified global security monitoring pipelines are generating PIPL cross-border transfers continuously, without the required mechanisms, without being aware. The CAC inquiry is the first notification.
DSL data classification schemes that do not align with national standard requirements
DSL requires organisations handling data in China to implement a data classification system aligned with national standards, covering at minimum the categories of general data, important data, and core data. ISO 27001 risk assessment drives classification by confidentiality, integrity, and availability impact. These are different classification dimensions. In assessed environments, ISO 27001-based classification schemes were presented as satisfying DSL classification requirements. They addressed security sensitivity. They did not identify important data or core data as defined under DSL and its implementing standards, which are defined by sector and reference national security, economic operation, and public interest criteria, not information security impact.
Important data designation under DSL triggers specific obligations: security assessments before cross-border transfer, processing activity reporting to sector regulators, and enhanced protection measures. An organisation that has not correctly classified its data under DSL does not know which of its data triggers these obligations. The ISO 27001 classification tells it which data is confidential. The DSL classification tells it which data is important. These are not the same question and the ISO 27001 answer does not substitute for the DSL answer.
PIPL consent mechanisms that collect agreement without implementing the consent standard
PIPL requires consent for personal information processing to be voluntary, explicit, and informed, with separate consent for sensitive personal information processing and cross-border transfer. In assessed organisations, consent was collected through a terms of service acceptance that bundled personal information processing terms with general service terms. Sensitive personal information was not identified separately in the consent flow. Cross-border transfer was described in the privacy policy but not presented as a separate consent item. The consent form existed and was accepted as ISO 27001 evidence of data handling procedures. It did not satisfy PIPL consent requirements.
PIPL enforcement actions have specifically targeted bundled consent, where acceptance of service terms constitutes consent to personal information processing. The CAC position is that consent must be separate and specific. An organisation whose consent mechanism bundles all processing into a single acceptance has not obtained valid PIPL consent. All downstream processing based on that consent is unsupported. The ISO 27001 documentation records that a consent mechanism exists. It does not evaluate whether the mechanism satisfies PIPL's consent standard.
Alibaba Cloud and Tencent Cloud storage bucket configurations with access controls not mapped to DSL data category
In assessed environments running on Chinese cloud infrastructure, storage bucket access controls were configured according to ISO 27001 access control principles: least privilege, role-based access, periodic review. The configurations were not mapped to DSL data categories. Important data was stored in buckets with the same access control configuration as general data. The enhanced protection requirements for important data under DSL, including more restrictive access logging, more frequent review cycles, and specific encryption requirements for data at rest and in transit, were not applied because the data had not been classified as important under DSL.
DSL-compliant access control is not a more restrictive version of ISO 27001 access control. It is access control applied to a different classification scheme. An organisation that implements ISO 27001 access controls correctly and has not mapped to DSL categories has the right mechanism applied to the wrong classification. The security is real. The regulatory compliance is absent.
A Statement of Applicability that excludes controls is more credible than one that includes all 93
Common belief
A thorough ISO 27001 Statement of Applicability includes all 93 Annex A controls as applicable, demonstrating comprehensive security coverage. Organisations with China regulatory exposure should include all controls to demonstrate maximum diligence.
What we found
In assessed organisations with China operations, the SoA was rarely mapped to CSL, DSL, or PIPL obligations. Where it was, the mapping was at the control domain level, not the specific obligation level. No assessed SoA contained a specific reference to PIPL Article 38 cross-border transfer mechanism requirements, DSL important data classification criteria, or CSL CII designation implications. The controls were documented as applicable. The regulatory obligations they were supposed to address were not.
An SoA that includes all 93 controls without exclusion is a red flag in an ISO 27001 audit, not a sign of comprehensiveness. The SoA process requires organisations to justify which controls apply based on the risk assessment. An organisation with no physical premises applying physical security controls, or a small team applying controls designed for large organisations with complex hierarchies, is demonstrating that it has not conducted a genuine risk assessment-driven control selection process. The controls are listed as applicable because the organisation is covering bases, not because the risk assessment identified the need.
For China compliance purposes, the SoA inflation problem runs deeper. When all 93 controls are listed as applicable, none of them receive the specific implementation attention that the actual risk requires. An organisation that treats A.5.10 as applicable without implementing the PIPL cross-border transfer mechanism has a box checked and a regulatory gap. An organisation that explicitly scopes A.5.10 to its China cross-border transfer obligations, documents the PIPL mechanism requirements, and implements accordingly has done the work.
ISO 27001 certification auditors look at the SoA to understand whether the organisation has engaged with its risk context. An SoA with no exclusions tells the auditor the organisation has not. A China regulatory gap analysis looks at whether the SoA maps to the specific obligations of CSL, DSL, and PIPL. Almost none do.
What China regulatory enforcement actually examines
PIPL cross-border data transfer volume thresholds triggering mandatory CAC security assessment: transfers of personal information of 1 million or more individuals cumulatively, or sensitive personal information of 100,000 or more individuals
Cyberspace Administration of China, Measures for the Security Assessment of Cross-Border Data Transfers, effective September 2022. Many organisations with moderate China user bases cross these thresholds without having conducted the required security assessment. The threshold applies to cumulative transfers, not single events. A SIEM ingesting daily logs crosses the threshold for personal information of 1 million individuals within months for any organisation with meaningful China market presence.
CAC published 45 enforcement cases related to data security and personal information protection between 2022 and 2024, with penalties including fines, suspension of services, and mandatory rectification
Cyberspace Administration of China enforcement announcements, 2022 to 2024. The cases concentrate in three areas: cross-border transfer without approved mechanism, consent mechanism failures, and data breach response failures. ISO 27001 certification appears in none of the enforcement cases as a mitigating factor.
PIPL standard contract filing with local CAC must occur within 10 working days of contract execution, and failure to file is independently actionable regardless of whether the contract itself is compliant
CAC, Personal Information Protection Law Standard Contract Measures, effective June 2023. This procedural step is the most consistently missed element in assessed organisations that have otherwise correctly identified the standard contract mechanism as their cross-border transfer compliance approach.
Where ISO 27001-based compliance programs fail to look in China
Security tooling data flows as PIPL cross-border transfers
Every security and operational tool that ships data from China-based infrastructure to non-China infrastructure is a potential PIPL cross-border transfer if that data contains personal information. SIEM, APM, log aggregation, vulnerability scanners with cloud reporting, and threat intelligence platforms with cloud telemetry are all common sources. These tools are in scope for ISO 27001 as security controls. Their data flows are not evaluated as PIPL compliance objects during ISO 27001 certification. The gap is systematic.
DSL data classification applied to cloud infrastructure configuration
DSL important data classification is not an abstract categorisation exercise. It has direct implications for cloud storage configuration, access control design, encryption requirements, and cross-border transfer decisions. Organisations that complete DSL classification as a documentation exercise without mapping the output to their cloud infrastructure configuration have classified data that is managed the same way as unclassified data. The classification exists. The protection differential does not.
CII designation implications for sector-specific obligations
CSL Critical Information Infrastructure designation is sector-determined by sector regulators (banking, energy, transport, water, healthcare, and others). Organisations in designated sectors have additional obligations beyond standard CSL requirements, including mandatory security assessments, stricter data localisation, and procurement restrictions on network products and services. ISO 27001 does not address CII designation. Organisations in affected sectors that are not certain of their CII status need to determine it through their sector regulator, not through the ISO 27001 process.
Data subject rights implementation under PIPL
PIPL grants Chinese individuals rights including access, correction, deletion, portability, and the right to withdraw consent. These rights require technical implementation: a mechanism for submitting requests, a process for responding within defined timelines, and logging of requests and responses. ISO 27001 A.5.34 addresses privacy and protection of personal identifiable information and references applicable regulations. It does not specify PIPL response timelines or the technical mechanisms required. Assessed organisations frequently have a privacy policy describing data subject rights and no functional mechanism for exercising them.
What ISO 27001-certified China-market organisations say before gap analysis, and what assessment finds
We have ISO 27001 certification covering our China operations. Our security posture is documented and audited.
Root cause:ISO 27001 certification documents that the organisation has implemented an ISMS and the controls selected through its risk assessment. It does not document compliance with CSL, DSL, or PIPL. The CAC does not recognise ISO 27001 certification as evidence of compliance with Chinese data regulations. A CAC inquiry will ask for PIPL cross-border transfer mechanism documentation, DSL data classification records, and consent evidence. The ISO 27001 certificate will not satisfy any of those requests.
We use a global SIEM for security monitoring. That's a security control, not a data transfer.
Root cause:Under PIPL, cross-border transfer is defined by data movement, not by purpose. A security log that contains an IP address associated with a Chinese user account is personal information under PIPL. Routing that log to a non-China SIEM is a cross-border transfer of personal information regardless of the operational purpose. The PIPL cross-border transfer mechanism requirements apply. The security purpose of the transfer does not create an exemption.
Our privacy policy covers PIPL requirements. Users accept it when they register.
Root cause:PIPL requires specific, separate, voluntary consent for personal information processing, with additional separate consent for sensitive personal information and cross-border transfer. A privacy policy accepted as part of service registration is not separate consent. It is bundled consent, which the CAC has specifically targeted in enforcement actions. The privacy policy accurately describes what the organisation does. It does not satisfy the PIPL consent standard for what the organisation is doing.
We executed a standard contract with our overseas data recipient. Cross-border transfer is handled.
Root cause:The standard contract mechanism requires three completed steps: execution of the CAC-prescribed template without material modification, internal personal information protection impact assessment before execution, and filing with the local CAC office within 10 working days of execution. Assessed organisations that have executed the standard contract have frequently not completed the impact assessment or filed with the local CAC. Two of the three required steps are absent. The mechanism is not complete.
Where China data compliance enforcement will focus in the next two years
By 2027, CAC enforcement will specifically target security tooling vendors whose cloud telemetry products transfer Chinese personal information outside China without approved mechanisms, creating liability for both the vendor and the organisations using the tools.
The SIEM and security tooling data flow gap is systemic across China-market organisations. It affects nearly every ISO 27001-certified organisation running unified global security monitoring. The CAC has the regulatory basis to act under PIPL and the enforcement pattern suggests it will move up the supply chain from individual organisations to the tooling that creates the systematic gap. Security vendors with China customers running cloud-connected products are the structural source of the problem.
Confidence: mediumA CAC enforcement action naming a security tooling vendor as a respondent for cross-border transfer violations through cloud telemetry, or published CAC guidance specifically addressing security tool data flows, by end of 2027.DSL data classification enforcement will produce the first significant fines for organisations that hold ISO 27001 certification but lack DSL-compliant important data classification schemes within 18 months.
DSL has been in force since September 2021. The implementing standards for data classification are established. Enforcement has focused on cross-border transfer and personal information protection. The next logical enforcement target is data classification compliance, where the gap between ISO 27001 classification and DSL classification is systematic and verifiable. The enforcement evidence is easy to obtain: request the organisation's data classification scheme and compare it to DSL national standard criteria.
Confidence: mediumA published CAC or sector regulator enforcement action citing DSL data classification failures in an organisation with ISO 27001 certification, within 18 months of this article's publication.
The problem is not that ISO 27001 is inadequate. It is that organisations treat it as a substitute for regulatory compliance work.
ISO 27001 is a good framework for managing information security risk. It is not a regulatory compliance framework and it was never designed to be one. The mistake is organisational: compliance teams achieve ISO 27001 certification, the organisation lists it in its regulatory compliance inventory, and the specific work of mapping to CSL, DSL, and PIPL obligations does not happen because the certification creates a sense that it has. The certification is real. The compliance gap is also real. Both things are true simultaneously, and the CAC enforcement action is the moment they stop being simultaneous.
Counterargument
The counterargument is that ISO 27001 provides a foundation that makes CSL, DSL, and PIPL compliance faster and cheaper to achieve. An organisation with a working ISMS, documented controls, and a risk management process is better positioned to implement China-specific requirements than one starting from nothing. This is true and organisations that have done the ISO 27001 work genuinely have an advantage. The error is treating the foundation as the building. The China-specific requirements are a separate project that the foundation supports but does not complete.
One thing to do this week
Map your SIEM and security monitoring data flows against PIPL cross-border transfer requirements. List every tool that ships data from China-based infrastructure to non-China infrastructure. For each one, determine whether the data contains personal information as defined by PIPL (which includes IP addresses, device identifiers, and behavioural data associated with identifiable individuals). For each tool that does, confirm which of the three PIPL cross-border transfer mechanisms is in place: CAC security assessment completion, standard contract executed and filed, or approved institution certification. The tools that have no mechanism are your immediate regulatory exposure. This takes a day to complete and is the starting point for every China CSL DSL PIPL gap analysis. Everything else follows from knowing what is moving where.
Further Reading
Gap Analysis
framework gap analysisVulnerability Assessment
vulnerability assessmentsNIST Vulnerability Assessment Definition
NIST's vulnerability assessment definitionNIST Cybersecurity Framework 2.0
NIST Cybersecurity FrameworkDigital Footprint - Canadian Cyber Centre
digital footprint best practices
Frequently Asked Questions
Does ISO 27001 certification satisfy China CSL, DSL, or PIPL compliance requirements?
No. ISO 27001 certification demonstrates that an organisation has implemented an Information Security Management System with documented controls. China's Cybersecurity Law, Data Security Law, and Personal Information Protection Law impose specific technical obligations that ISO 27001 Annex A controls do not address: mandatory data localisation for defined data categories, specific cross-border transfer mechanisms requiring CAC approval or standard contract filing, DSL-aligned data classification covering important data and core data tiers, and PIPL consent standards requiring separate and specific consent for personal information processing. The CAC does not recognise ISO 27001 certification as evidence of compliance with any of these requirements.
What are the three approved mechanisms for PIPL cross-border data transfer?
PIPL Article 38 requires one of three mechanisms for cross-border transfer of personal information: a security assessment conducted by the Cyberspace Administration of China, which is mandatory for Critical Information Infrastructure operators and organisations transferring personal information of 1 million or more individuals cumulatively; a standard contract using the CAC-prescribed template, executed before transfer and filed with the local CAC within 10 working days of execution; or certification by a CAC-approved institution. These mechanisms are specific procedural requirements. ISO 27001 data transfer controls do not satisfy any of them.
What is the difference between DSL data classification and ISO 27001 data classification?
ISO 27001 data classification is driven by the risk assessment: data is classified by its confidentiality, integrity, and availability impact. DSL data classification uses national standard criteria covering sector-specific definitions of general data, important data, and core data, where important data and core data are defined by reference to national security, economic operation, public interest, and individual rights criteria rather than information security impact. An organisation with ISO 27001 classification knows which data is confidential. It may not know which data qualifies as important data under DSL, which is the classification that triggers mandatory cross-border transfer assessment and enhanced protection requirements.
Why do security monitoring tools create PIPL compliance exposure for organisations in China?
PIPL defines personal information as any information relating to an identified or identifiable natural person, which includes IP addresses, device identifiers, and behavioural logs associated with user accounts. Security monitoring tools including SIEM, application performance monitoring, and cloud security platforms that ingest logs from China-based infrastructure and route them to non-China data centres are transferring personal information across borders under PIPL. The security purpose of the transfer does not create an exemption. Each such data flow requires one of the three approved PIPL cross-border transfer mechanisms. Most organisations running unified global security monitoring have not established these mechanisms for their security tooling data flows.
What does the CAC examine during a PIPL enforcement investigation?
CAC enforcement investigations examine: cross-border transfer mechanism documentation (security assessment completion records, standard contract with filing confirmation, or certification documentation); consent collection records demonstrating that personal information processing consent was separate, specific, and voluntary; data subject rights implementation evidence showing functional mechanisms for access, correction, deletion, and withdrawal of consent requests; and data classification records demonstrating DSL-aligned classification of important data and core data. ISO 27001 audit evidence addresses ISMS documentation, management review records, and control implementation. These evidence sets overlap in some areas and diverge in the areas that CAC enforcement concentrates on.
What is the standard contract filing requirement under PIPL and how is it commonly missed?
The PIPL standard contract mechanism requires three steps: execution of the CAC-prescribed standard contract template without material modification, completion of a personal information protection impact assessment before execution, and filing of the executed contract with the local CAC office within 10 working days of execution. The filing step is the most consistently missed. Organisations that execute the standard contract but fail to file it have not completed the mechanism. The filing creates the regulatory record of the transfer. CAC enforcement has specifically targeted the filing step because its absence is documentable and the transfer is otherwise unsupported.
How should an ISO 27001 Statement of Applicability be adapted for China compliance?
An SoA designed to support China compliance should map relevant Annex A controls to CSL, DSL, and PIPL obligations specifically, not at the domain level but at the specific obligation level. A.5.10 should reference PIPL Article 38 cross-border transfer mechanism requirements and document which mechanism applies to each identified transfer. A.5.12 should reference DSL data classification national standards and document how the organisation's classification scheme maps to important data and core data criteria. A.8.11 should reference CSL and DSL data deletion obligations with their specific timelines. Controls that are listed as applicable without this regulatory mapping are documentation without operational meaning for China compliance purposes.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.