In case the user authentication is outsourced for a company, does it need to be included in the scope? I think that even if it is outsourced it must be included in the scope definition.

  • 1
    What do you mean by "does it need to be included"? According to whom? It is the organisation that has to decide what needs to be included and what doesn't. The standard says that the scope must be specified, documented, and managed. – techraf Jul 31 '16 at 12:52

It may not have to be included in the scope definition. However, it would be difficult to have information security management system (ISMS) without user authentication (see section A.9 on access control). The boundaries of the ISMS (scope) need to be established after considering the needs and expectations of the interested parties.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.