I'm trying to write and implement an ISO 27001 compliant information security management system (ISMS) for the company I work for. Currently we have our HQ the UK (2 office locations plus a test site) and an additional office in Europe.

Currently the goal is to have the ISMS applicable to the UK locations and the EU location is scoped out as a subsidiary / third party providing design services to the UK organisation. The EU office also manages the IT infrastructure of the whole organisation. I'm not sure the reason the EU is scoped separately but I believe it's to avoid complexity and expense.

We share intellectual property and confidential information (just technical, generally no Personally Identifiable Information) back and forth between the UK and EU offices and eventually plan to move to a shared cloud database managed by the UK but EU has access and contributes.

How will ISMS work in this situation? Are subsidiary and third parties considered the same under ISMS?

Currently the intention is to have the EU office contracted at a third party/ subsidiary to provide design and IT management services to the UK organisation.

The contract will stipulate the security requirements the EU branch must follow. I'm assuming the requirements will be dependant on the type of information shared but seeing as we intend to have a joint database, they'll likely have to follow most, if not all, UK ISMS requirements.

And someone within the UK organisation must be accountable for the ISMS, it cannot be someone within the EU branch right?

  • You should have posted this on law stackexchange.
    – Coderxyz
    Sep 10, 2022 at 9:51

1 Answer 1


Since the EU office manages the IT infrastructure of the whole organisation and therefore has unrestricted access to all electronic data, scoping it out is not going to fly. Any part of the business that has administrative control over your information assets should be, as far as any auditor is concerned, a mandatory part of your ISMS.

Even if you consider it a subsidiary from a company structure perspective, their IT management role would be identified as a critical business function during evaluation of Clause 4.1, and also make them an important interested party as part of Clause 4.2, meaning that you would not be able to justify excluding them from the scope in Clause 4.3.

As time has gone on, certification bodies like UKAS have grown more insistent upon ISMS scope including the whole organisation, and you will find it very difficult to convince them that your IT department can be exempt just because they're in the EU office. If they were genuinely a third party contractor with no direct business relationship, then you would need to go through a more complicated procedure of defining a contract that integrates with your ISMS (as you alluded to) and incorporating noncompliance risks into your risk management strategy, but I very much doubt that that approach would be accepted by an assessor in your case. At best they'll make you do a lot more work, at worst they'll think you're trying to cheat.

I'm not sure what the residence rules are for responsibility of the ISMS. They may have changed since Brexit, you will need to discuss that with your certification body.

  • From what I've read, including linkedin.com/pulse/how-do-iso27001-only-part-company-chris-hall, it's quite common to certify part of a company. Particularly if one is in a different geographic location. However, I agree that it's illogical that the IT side is scoped out for the reasons you said
    – user282603
    Sep 10, 2022 at 19:35
  • It's certainly possible to scope out segments of the business when there's a legitimate reason to do so, for sure, but as time has gone on the certifying bodies have become more insistent upon strong reasons to do so, and less receptive to restrictive ISMS scopes.
    – Polynomial
    Sep 11, 2022 at 15:04
  • This is an interesting point. I have a requirement to certify a sub-function of my business with ISO 27k. I can't certify the whole business and have that carried through. I need to prove that the sub-function is certified separately.
    – schroeder
    Oct 9, 2022 at 20:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .