2

I'm in the process of defining the scope definition according to ISO 27001 for a company whose core business process is based on the analysis of health-related data. The IT infrastructure is entirely based on the cloud and the company has no dedicated physical location. This is a small size organization (20+ people) all work remotely by connecting to the cloud.

Given this scenario, can we implement ISO 27001 for my organization without a dedicated location? The organization is registered.

  • 1
    There are some articles on this, like: advisera.com/27001academy/blog/2017/05/22/… – schroeder Mar 2 '18 at 16:25
  • Any feedback, Santhosh? – Tom K. Aug 13 '18 at 6:06
  • Have you possibly resolved the problem Santhosh? I have still not been able to find a loophole around the physical address requirement, nor could we find an approved certification body willing to certify an ISMS like this. – Joe Dec 27 '18 at 3:02
1

Unfortunately, it is not possible right now to certify a company to ISO 27001 without a physical location in scope @Santhosh.

While @Tom is right by stating there is nothing in the ISO 27001 standard that mandates a physical location, you will have a really hard time finding a certification body willing to accept such a scope.

This is because the document:

"ISO/IEC 17021-1:2015 Conformity assessment -- Requirements for bodies providing audit and certification of management systems -- Part 1: Requirements." that is available here: https://www.iso.org/standard/61651.html states in clause 8.2.2 a) that a geographic location is required for the certificate.

With no geographic location to place on the certificate, no certification body I have been able to contact is willing to certify the ISMS.

  • But the business itself should have a registered physical address for other reasons (business licenses, taxes, etc.) Could that address not be used? – schroeder Aug 13 '18 at 7:59
  • @schroeder: Well, the standard says "geographic location". Maybe you could just widen your scope and/or the included processes to also include the registered physical address for some reason - tax filing for instance. I'm not too sure about the legal ramifications and as always: it all depends on the certification body in the end. – Tom K. Aug 13 '18 at 8:37
  • The physical address can be used but should also then be in scope. Have seen some crazy hacks where e.g. 1 room in a building is ‘in scope’ because of this. Agree with @TomK. that it is up to the certification body but in Aus / Asia a physical location is required due to clause 8.2.2 – Joe Aug 13 '18 at 10:14
0

Nothing in the ISO 27001 stops you from this. Simply follow the normal process to define your scope properly. When implementing the Annex A controls you will find that in many cases in place of technical controls you will have contractual agreements with the cloud provider. That is absolutely normal within the ISO 27001 process.

  • have you been able to get an ISMS certified with no physical location? How did you get around the ISO/IEC 17021-1:2015 limitations? – Joe Aug 13 '18 at 5:07
  • I'm in the process of certifying a similar organisation right now where the scope is limited to a couple cloud-based services. It caused us a couple headaches to get all the supplier contracts stuff right, especially inter-company, but we got a green flag on the external pre-audit and are a few weeks away from the certification audit. You can, of course, not entirely ignore any aspect of ISO 27001 (Annex), but you can scope it out and move it to supplier relations if outsourced. In many cases that is more work than just applying the physical controls, but if the customer wants it... – Tom Aug 13 '18 at 8:26
  • would be great to have more information, let me know how it worked out please! Case studies might help me resolve it on my end! – Joe Aug 13 '18 at 10:16
  • I won't be able to provide details due to NDAs and professional conduct. But essentially the idea is that if your organisation is not responsible for the physical security, it anyway can't apply controls. In that case, by how I interpret the ISO, you need to ensure that your supplier does provide adequate physical security, and that moves the whole topic into the supplier relationship chapter. – Tom Aug 14 '18 at 6:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.