I would like to define the scope of the ISMS for an organisation in which information assets are sitting entirely on the cloud and managed through services provided by the cloud (even storing the data is provided as an abstracted service, which implies that the provider is responsible for networking, OS, firewall configuration, physical security). These data and cloud provided services are accessed and processed for various purposes by our main office in another region.
I understand that the basic responsibility of us in such cloud provider settings is to secure data at rest, in transit and manage access controls. In terms of ISO27001 scoping, I need to define the regions inside the scope. Is the cloud centre provider's location going to be in the scope (assuming all the services used are already covered by the ISO 27001 certificate of the cloud provider) or just left as an exception and state that it is treated via SLAs? If it is left out, the only region in the scope is this of the office accessing this data located in the cloud?
