An organization is preparing to seek ISO/IEC 27001 certification to support bids for contracts in its managed services business line. How should the scope of the information security management system BEST be defined?
Select an answer to reveal the explanation.
Short Explanation
If you're getting a certificate to win managed services contracts, the certificate had better cover managed services. You scope it around what the business objective depends on, rather than whatever's easiest to certify.
Full Explanation
The scope of an information security management system defines the boundaries within which the organization manages information security and to which certification applies. Because certification here is intended to support contract bids for the managed services business line, the scope should include the processes, locations, people, technology and information that line depends on, including interfaces with other parts of the organization. A scope aligned to the business objective gives customers meaningful assurance and makes the certificate useful. Limiting scope to the IT department reflects a mistaken view that information security is purely technical; the services customers buy depend on business processes, people and suppliers outside IT, and a certificate covering only IT may not satisfy customers. Choosing the smallest possible scope to certify cheaply produces a certificate that customers may find irrelevant to the services they are buying, defeating the purpose. Including every subsidiary in the first cycle regardless of relevance adds cost and delay without serving the stated objective; scope can be extended in later cycles if business needs change. Exam caveat: exclusions must be justified and interfaces at the boundary managed. Operational check: confirm the scope statement names the business line, its processes and locations, and the justification for any exclusions.