Is it possible for an entity or a division part of an organization to be certified ISO 27001, specifically the Division Information Security Management System?


Yes, that is possible. ISO27001 requires you to define the scope of the certification, so you could restrict the scope to that one specific division.

Of course, any smart auditor would check what relations that division has with other divisions and which risks and controls are related to that.

  • Can you please provide me with the explanation of '' controls"? – user16672 Apr 17 '16 at 16:40
  • 1
    Controls are measures taken to reduce the chance and or impact of certain risks. – Teun Vink Apr 17 '16 at 16:43
  • 1
    While it is definitely possible, the scoping in this particular case has to be done very well. If you have never been involved in this process, you should probably get outside help. – Tom K. Feb 19 '18 at 8:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy