ISO27001 Scoping : Defining boundaries

Question

I would like to define the scope of the ISMS for an organisation in which information assets are sitting entirely on the cloud and managed through services provided by the cloud (even storing the data is provided as an abstracted service, which implies that the provider is responsible for networking, OS, firewall configuration, physical security). These data and cloud provided services are accessed and processed for various purposes by our main office in another region.

I understand that the basic responsibility of us in such cloud provider settings is to secure data at rest, in transit and manage access controls. In terms of ISO27001 scoping, I need to define the regions inside the scope. Is the cloud centre provider's location going to be in the scope (assuming all the services used are already covered by the ISO 27001 certificate of the cloud provider) or just left as an exception and state that it is treated via SLAs? If it is left out, the only region in the scope is this of the office accessing this data located in the cloud?

Answer 1

The cloud centre provider's location is not going to be in your scope. You will "control" them through A.15 Supplier Relationships of the standard. You will not have direct control over their physical location. It will be treated as you say via SLA. The only region in the scope may well be the office accessing the data located in the cloud as well as what the standard calls "teleworkers" i.e. those who are remote. Hope that helps!