ISO 27001 and Subsidaries

Question

I'm trying to write and implement an ISO 27001 compliant information security management system (ISMS) for the company I work for. Currently we have our HQ the UK (2 office locations plus a test site) and an additional office in Europe.

Currently the goal is to have the ISMS applicable to the UK locations and the EU location is scoped out as a subsidiary / third party providing design services to the UK organisation. The EU office also manages the IT infrastructure of the whole organisation. I'm not sure the reason the EU is scoped separately but I believe it's to avoid complexity and expense.

We share intellectual property and confidential information (just technical, generally no Personally Identifiable Information) back and forth between the UK and EU offices and eventually plan to move to a shared cloud database managed by the UK but EU has access and contributes.

How will ISMS work in this situation? Are subsidiary and third parties considered the same under ISMS?

Currently the intention is to have the EU office contracted at a third party/ subsidiary to provide design and IT management services to the UK organisation.

The contract will stipulate the security requirements the EU branch must follow. I'm assuming the requirements will be dependant on the type of information shared but seeing as we intend to have a joint database, they'll likely have to follow most, if not all, UK ISMS requirements.

And someone within the UK organisation must be accountable for the ISMS, it cannot be someone within the EU branch right?

Answer 1

Since the EU office manages the IT infrastructure of the whole organisation and therefore has unrestricted access to all electronic data, scoping it out is not going to fly. Any part of the business that has administrative control over your information assets should be, as far as any auditor is concerned, a mandatory part of your ISMS.

Even if you consider it a subsidiary from a company structure perspective, their IT management role would be identified as a critical business function during evaluation of Clause 4.1, and also make them an important interested party as part of Clause 4.2, meaning that you would not be able to justify excluding them from the scope in Clause 4.3.

As time has gone on, certification bodies like UKAS have grown more insistent upon ISMS scope including the whole organisation, and you will find it very difficult to convince them that your IT department can be exempt just because they're in the EU office. If they were genuinely a third party contractor with no direct business relationship, then you would need to go through a more complicated procedure of defining a contract that integrates with your ISMS (as you alluded to) and incorporating noncompliance risks into your risk management strategy, but I very much doubt that that approach would be accepted by an assessor in your case. At best they'll make you do a lot more work, at worst they'll think you're trying to cheat.

I'm not sure what the residence rules are for responsibility of the ISMS. They may have changed since Brexit, you will need to discuss that with your certification body.