I'm in the process of defining the scope definition according to ISO 27001 for a company whose core business process is based on the analysis of health-related data. The IT infrastructure is entirely based on the cloud and the company has no dedicated physical location. This is a small size organization (20+ people) all work remotely by connecting to the cloud.

Given this scenario, can we implement ISO 27001 for my organization without a dedicated location? The organization is registered.

  • 1
    There are some articles on this, like: advisera.com/27001academy/blog/2017/05/22/…
    – schroeder
    Commented Mar 2, 2018 at 16:25
  • Any feedback, Santhosh?
    – Tom K.
    Commented Aug 13, 2018 at 6:06
  • Have you possibly resolved the problem Santhosh? I have still not been able to find a loophole around the physical address requirement, nor could we find an approved certification body willing to certify an ISMS like this.
    – Joe
    Commented Dec 27, 2018 at 3:02

2 Answers 2


Unfortunately, it is not possible right now to certify a company to ISO 27001 without a physical location in scope @Santhosh.

While @Tom is right by stating there is nothing in the ISO 27001 standard that mandates a physical location, you will have a really hard time finding a certification body willing to accept such a scope.

This is because the document:

"ISO/IEC 17021-1:2015 Conformity assessment -- Requirements for bodies providing audit and certification of management systems -- Part 1: Requirements." that is available here: https://www.iso.org/standard/61651.html states in clause 8.2.2 a) that a geographic location is required for the certificate.

With no geographic location to place on the certificate, no certification body I have been able to contact is willing to certify the ISMS.

  • But the business itself should have a registered physical address for other reasons (business licenses, taxes, etc.) Could that address not be used?
    – schroeder
    Commented Aug 13, 2018 at 7:59
  • @schroeder: Well, the standard says "geographic location". Maybe you could just widen your scope and/or the included processes to also include the registered physical address for some reason - tax filing for instance. I'm not too sure about the legal ramifications and as always: it all depends on the certification body in the end.
    – Tom K.
    Commented Aug 13, 2018 at 8:37
  • The physical address can be used but should also then be in scope. Have seen some crazy hacks where e.g. 1 room in a building is ‘in scope’ because of this. Agree with @TomK. that it is up to the certification body but in Aus / Asia a physical location is required due to clause 8.2.2
    – Joe
    Commented Aug 13, 2018 at 10:14

Nothing in the ISO 27001 stops you from this. Simply follow the normal process to define your scope properly. When implementing the Annex A controls you will find that in many cases in place of technical controls you will have contractual agreements with the cloud provider. That is absolutely normal within the ISO 27001 process.

  • have you been able to get an ISMS certified with no physical location? How did you get around the ISO/IEC 17021-1:2015 limitations?
    – Joe
    Commented Aug 13, 2018 at 5:07
  • I'm in the process of certifying a similar organisation right now where the scope is limited to a couple cloud-based services. It caused us a couple headaches to get all the supplier contracts stuff right, especially inter-company, but we got a green flag on the external pre-audit and are a few weeks away from the certification audit. You can, of course, not entirely ignore any aspect of ISO 27001 (Annex), but you can scope it out and move it to supplier relations if outsourced. In many cases that is more work than just applying the physical controls, but if the customer wants it...
    – Tom
    Commented Aug 13, 2018 at 8:26
  • would be great to have more information, let me know how it worked out please! Case studies might help me resolve it on my end!
    – Joe
    Commented Aug 13, 2018 at 10:16
  • I won't be able to provide details due to NDAs and professional conduct. But essentially the idea is that if your organisation is not responsible for the physical security, it anyway can't apply controls. In that case, by how I interpret the ISO, you need to ensure that your supplier does provide adequate physical security, and that moves the whole topic into the supplier relationship chapter.
    – Tom
    Commented Aug 14, 2018 at 6:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .