2

If a company wants to certify against some of ISO 27000-series standards (let's say ISO 27001 and ISO 27005), what could possibly be certified? I mean, is it IT processes in general in the organisation as a whole? Or is it more likely that only one/several system(s) used in that company is/are certified? OR does it depend on particular standard (let's say I am interested in the ones above)?

If a company has chosen some particular standard, can it be broken down somehow so that only a part of the standard is certified?

Improve this question
1
  • First the Scope should be determined based on the requirement and enough discussions shall be made with the help of management on what services/branches are in scope. We wouldn't be able to take only the IT processes but this applies to complete processes. Standards cannot be broken down
    – user72577
    Commented Apr 16, 2015 at 9:10

2 Answers 2

Reset to default
3

Of the ISO 27000 range of documents, only 27001 is a certifiable standard. The others in the range are guidance and advisory documents.

The first step of ISO 27001 implementation is defining the scope. In my experience it would be unusual to have "IT Processes" as a scope - it's usually defined by business area. So for example the Operations part of the business (excluding supporting business units, such as HR).

You can't be certified to part of ISO 27001. It's all or nothing.

Improve this answer
3
  • Thanks for the response. It's very valuable, as I'm just getting my feet wet. Could you please be so kind and give other examples of possible scope? Maybe there are web materials to read on initial steps for certification?
    – ZygD
    Commented Mar 23, 2015 at 16:53
  • Also, how can you exclude HR, e.g. if an auditor wants to assess the procedure of access rights granting to information resources, he might take a sample where he would see an employee in HR dept. being granted access. So how can the scope be defined on operations side and not on particular information systems? This stardard is about information security after all.
    – ZygD
    Commented Mar 24, 2015 at 0:12
  • @ZygD: You can exclude the HR function and processes from your ISO 27001 scope, that doesn't mean they cannot be part of a control activity (such as granting access-rights). These are two different things.
    – ack__
    Commented Nov 12, 2015 at 10:10
1

The ISO 2700X series is about certifying the security management of a company. You are certified on the 27001 by the way.

The scope is to be defined by the company. To do so, you implement the requirements of the norm (chapters 4 to 8) without exception.

Chapter 4 revolves around the Deming circle (PDCA) and defines the ISMS set-up, implementation and exploitation, control and review, and enhancement.

Chapter 5 deals with management responsibility, Chapter 6 with internal audits, Chapter 7 with review and Chapter 8 with corrective and preventive actions.

Definition of the scope is driven by the chapter 4.2.1 a and 4.2.1 b of ISO27001. You have to look at the many aspects of the organisational perimeter, information system perimeter and physical perimeter.

Usually the norm gives guidelines, there is no precise definition of what must be in the scope and what is not. You can also refer to ISO27002 which gives good practices.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .