In case the user authentication is outsourced for a company, does it need to be included in the scope? I think that even if it is outsourced it must be included in the scope definition.

  • 1
    What do you mean by "does it need to be included"? According to whom? It is the organisation that has to decide what needs to be included and what doesn't. The standard says that the scope must be specified, documented, and managed.
    – techraf
    Commented Jul 31, 2016 at 12:52

1 Answer 1


It may not have to be included in the scope definition. However, it would be difficult to have information security management system (ISMS) without user authentication (see section A.9 on access control). The boundaries of the ISMS (scope) need to be established after considering the needs and expectations of the interested parties.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .