I'm trying to write and implement an ISO 27001 compliant information security management system (ISMS) for the company I work for. Currently we have our HQ the UK (2 office locations plus a test site) and an additional office in Europe.
Currently the goal is to have the ISMS applicable to the UK locations and the EU location is scoped out as a subsidiary / third party providing design services to the UK organisation. The EU office also manages the IT infrastructure of the whole organisation. I'm not sure the reason the EU is scoped separately but I believe it's to avoid complexity and expense.
We share intellectual property and confidential information (just technical, generally no Personally Identifiable Information) back and forth between the UK and EU offices and eventually plan to move to a shared cloud database managed by the UK but EU has access and contributes.
How will ISMS work in this situation? Are subsidiary and third parties considered the same under ISMS?
Currently the intention is to have the EU office contracted at a third party/ subsidiary to provide design and IT management services to the UK organisation.
The contract will stipulate the security requirements the EU branch must follow. I'm assuming the requirements will be dependant on the type of information shared but seeing as we intend to have a joint database, they'll likely have to follow most, if not all, UK ISMS requirements.
And someone within the UK organisation must be accountable for the ISMS, it cannot be someone within the EU branch right?