With ISO 27001, you will need to establish a set of security controls and objectives based on operations intended to handle risk management of private customer information. The great part is that this step provides you with a direct pathway to compliance for secured privacy.