A provider offers its ISO/IEC 27001 certificate as proof of sound security. The customer plans to use a data analytics service and a geographic region that the provider launched only last year. What should the customer verify before relying on the certificate?
Select an answer to reveal the explanation.
Short Explanation
A diploma only covers the courses you actually took. A certificate's scope tells you which services and locations were audited, and anything launched since may not be on it. The trap is checking that the certificate is current and forgetting to check what it covers.
Full Explanation
ISO/IEC 27001 certification applies to a defined information security management system scope, stated on the certificate and supported by a statement of applicability listing which Annex A controls apply and why. Providers often certify a subset of services, locations or organizational units, and newly launched services or regions may not yet be included until a later surveillance or recertification audit extends the scope. The customer must confirm that the specific analytics service and region it will use fall within the certified scope before treating the certificate as evidence. Assuming a certificate covers every service ignores that scope is defined by the certified organization and can be narrow. Checking only the expiry date confirms the certificate is valid but says nothing about whether the new service and region were ever assessed. Claiming ISO/IEC 27001 does not apply to cloud services is false; it applies to any organization's ISMS, while ISO/IEC 27017 supplements it with cloud-specific control guidance rather than replacing it. Exam caveat: the 2026 outline drops ISO/IEC 27017 as a named example under verification against criteria, but scope checking still applies to any certification or attestation. Operational check: obtain the current certificate and scope statement, and confirm the service and region appear explicitly or are listed in the provider's compliance documentation.