ISO/IEC 27001 FAQ

The ISMS scope must establish the management system's boundaries and applicability. When setting it, the organization considers relevant internal and external issues, relevant interested-party requirements, and interfaces and dependencies between its activities and activities performed by other organizations. The scope must be available as documented information.

Teams should connect the scope to information handled by the business, not only to departments or platforms. If customer data, production environments, outsourced operations, or critical suppliers support the scoped service, the ISMS record should explain how those interfaces are governed.

Risk assessment should identify risks to the confidentiality, integrity, and availability of information within the ISMS scope, analyse them with defined criteria, and prioritize them for treatment. The record should show the asset, threat or weakness, business impact, likelihood or severity logic, risk owner, and current decision.

Risk treatment begins with treatment options selected in light of the assessment results. Common organizational options include modifying, avoiding, sharing, or retaining risk, but ISO/IEC 27001 does not impose that exact four-label taxonomy. The organization determines all necessary controls, checks them against Annex A, produces the SoA, formulates the treatment plan, and obtains risk-owner approval and residual-risk acceptance.

The Statement of Applicability connects risk treatment to the control set. It must contain the necessary controls, justification for their inclusion, whether those controls are implemented, and justification for excluding any Annex A controls. Necessary controls may be designed by the organization or drawn from sources beyond Annex A.

Keep the SoA traceable to risk-assessment results, applicable requirements, treatment options, implementation status, and evidence. Control owners and evidence locations are useful internal fields, but ISO/IEC 27001 does not require those exact fields to appear in the SoA.

Certification evidence should show both design and operation. Design evidence explains the ISMS scope, policies, risk process, control selection, SoA, objectives, roles, and procedures. Operating evidence shows the process ran: completed risk reviews, access reviews, security events, supplier reviews, training records, vulnerability handling, incident records, audit reports, management-review minutes, nonconformities, and corrective actions.

A surveillance audit samples continuing conformity during an active certification cycle. A certificate does not prove every control is permanently effective or every system secure; the organization still needs evidence that the scoped ISMS operated, changes were assessed, findings were handled, and management reviewed performance.

Internal audit must determine whether the ISMS conforms to ISO/IEC 27001 and to the organization's own requirements, and whether it is effectively implemented and maintained. The audit programme must consider process importance and previous audit results, so high-risk or repeatedly weak areas receive appropriate attention.

Management review is where leadership decides whether the ISMS remains suitable, adequate, and effective. Useful inputs include actions from previous reviews, changes in context, ISMS performance, audit results, risk assessment results, risk-treatment status, opportunities for improvement, and resource needs.

Treating ISO/IEC 27001 as a certificate project leaves the management system stale after the audit. Certification is separate from the organization's continuing duties to maintain scope, risk treatment, control operation, performance evaluation, and improvement records.

Another common mistake is copying every Annex A control into the SoA without risk-based reasoning. ISO/IEC 27001 expects teams to determine necessary controls from risk treatment, compare them with Annex A so controls are not overlooked, and justify exclusions. That is different from implementing every control identically across every environment.