apologies if my question is too basic but I am clearly not an expert on ISO 27001.

My company is B2B, our services include hosting data about our clients' users.

Data protection laws are important to us, and we must observe them carefully as our clients rightly demand their users' data is kept safe.

We are looking at obtaining ISO 27001 certification for 2 main reasons:

1. Force ourselves to follow rules and methodologies that help us keep that data safe
2. As a sales tool: In theory if we are ISO 27001 certified potential clients will trust us their data easier

So there are 2 sets of information: our clients' users' data, which is critical to be kept secure, and other data, such as our contacts database, our internal tasks and projects planner and calendar, sales presentations, etc. which so far we have created mainly through online tools like a web-based CRM, Google Calendar, and spreadsheets, EverNote, etc.

Finally my question: Must ISO 27001 cover all data and procedures across the company, or can it just apply to our core and most critical clients' users' data, and everything else (online tools like Google Calendar, an online CRM, Skype, Evernote...) we can still use, provided we don't publish any of the core data through these tools? We have been told no more Skype or online spreadsheets, the CRM must be hosted by us, any other web-based service like Evernote or similar is banned. Which is quite inconvenient because typically there is little choice in terms of tools you can host yourself in order to have absolute control over the data.

Thank you all in advance

My company is B2B, our services include hosting data about our clients' users.

Data protection laws are important to us, and we must observe them carefully as our clients rightly demand their users' data is kept safe.

We are looking at obtaining ISO 27001 certification for 2 main reasons:

1. Force ourselves to follow rules and methodologies that help us keep that data safe

2. As a sales tool: in theory if we are ISO 27001 certified potential clients will trust us their data easier

So there are 2 sets of information: our clients' users' data, which is critical to be kept secure, and other data, such as our contacts database, our internal tasks and projects planner and calendar, sales presentations, etc. which so far we have created mainly through online tools like a web-based CRM, Google Calendar, and spreadsheets, EverNote, etc.

Finally my question: Must ISO 27001 cover all data and procedures across the company, or can it just apply to our core and most critical clients' users' data, and everything else (online tools like Google Calendar, an online CRM, Skype, Evernote...) we can still use, provided we don't publish any of the core data through these tools? We have been told no more Skype or online spreadsheets, the CRM must be hosted by us, any other web-based service like Evernote or similar is banned. Which is quite inconvenient because typically there is little choice in terms of tools you can host yourself in order to have absolute control over the data.