I'm trying to define a scoping definition, as required by ISO27001, for a company that offers advice to customers based on health-related data. The strength of this company is its advice that offers to customers (analytics techniques). The data are coming from different third-parties (e.g. health apps, hospitals) and everything is hosted on the cloud, analysis is on the cloud and security is guaranteed by the cloud provider (at some degree) as the data are siting on their servers (might be on 2-3 different geo-locations).

The way I m thinking to formulate it is like: ISMS covering collection, aggregations and analysis of data. Any ideas on this?

1 Answer 1


As long as all the key services, processes and products are covered in the scope, it should be alright.

For example a statement like the following would also do -

ISMS covers the management, operation, and maintenance of information assets and information systems that enable the collection, aggregation, analysis and reporting of customer data.

The line above assumes that you own / manage the servers (even if they are on cloud) that store the customer data.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .