I m in the process of defining the scope definition according to ISO 27001 for a company that its core business process is based on the analysis of health-related data. The IT infrastructure is entirely based on the cloud and the company has one office from which employees access the cloud IT infrastructure and perform all their tasks on the cloud.

Is the location of the cloud provider going to be listed in the location under the scope of the ISMS? If yes, what evidence do you require to show to an accreditor, note that you can only access the cloud via the APIs - you dont have any access to physical location - however you are responsible for many things like firewalls - data security - access controls etc.

1 Answer 1


No. Not unless you have physical access to it and it is your cabinet/rack. It is likely they will have ISO 27001 certification already. If not you could require it of them. Or at least the right to audit. It is likely that your scope will be something like the protection of customer and corporate data in the provision of health-related analytics Location office @ ABC Street

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .