ISO 27001, Skype, online CRM... compatible? [duplicate]

Question

My company is B2B, our services include hosting data about our clients' users.

Data protection laws are important to us, and we must observe them carefully as our clients rightly demand their users' data is kept safe.

We are looking at obtaining ISO 27001 certification for 2 main reasons:

1. Force ourselves to follow rules and methodologies that help us keep that data safe

2. As a sales tool: in theory if we are ISO 27001 certified potential clients will trust us their data easier

So there are 2 sets of information: our clients' users' data, which is critical to be kept secure, and other data, such as our contacts database, our internal tasks and projects planner and calendar, sales presentations, etc. which so far we have created mainly through online tools like a web-based CRM, Google Calendar, and spreadsheets, EverNote, etc.

Finally my question: Must ISO 27001 cover all data and procedures across the company, or can it just apply to our core and most critical clients' users' data, and everything else (online tools like Google Calendar, an online CRM, Skype, Evernote...) we can still use, provided we don't publish any of the core data through these tools? We have been told no more Skype or online spreadsheets, the CRM must be hosted by us, any other web-based service like Evernote or similar is banned. Which is quite inconvenient because typically there is little choice in terms of tools you can host yourself in order to have absolute control over the data.

Answer 1

Whoever has said that you cannot use some specific technology because of ISO27001 probably has some other vested interest - possibly even just laziness. The standard does not mandate what you can and cannot do. It effectively defines the way you need to manage risk and how you need to demonstrate that you are managing risks.

There are many organisations who are compliant and who use Office 365 or even Google Work. Even more that have all manner of external communications from Skype to Slack, etc.

What matters is having a robust process for identifying and acknowledging the risks and mitigating them.

A specific example may help. Though not directly related to ISO27001, there are a number of doctors in the UK who are holding patient consultations over Skype. That requires certified risk management well beyond that normally expected from ISO27001 (think the UK equivalent of the US's HIPPA).