ISO/IEC 27001 scope, risk and Statement of Applicability
State the business activities, information, sites, technology and external interfaces covered. Cloud and supplier dependencies must be considered where they affect the stated scope.
MANAGEMENT SYSTEMS
Define the information-security boundary
State the business activities, information, sites, technology and external interfaces covered. Cloud and supplier dependencies must be considered where they affect the stated scope.
Connect risk to treatment
Use consistent criteria to identify, analyse and evaluate risks. Assign treatment actions and owners, justify residual-risk acceptance and keep the asset and dependency information traceable.
Make the Statement of Applicability useful
Explain which controls are necessary, why they are included or excluded, and their implementation status. Link decisions to risks and evidence; ISO/IEC 27002 guidance does not replace ISO/IEC 27001 system requirements.
Updated
A sound start verifies the real activity and applicable requirements before the service name.
ISO/IEC 27001 Information SecurityPrimary sources reviewed for this article