ISO 27001 clause 4.2 asks an organization to identify them and the requirements they place on information security, including legal, regulatory and contractual ones, and to decide which of those requirements the ISMS will address. The result usually lives in a short register that the scope, the risk assessment and the objectives refer back to.
Auditors use it to check that the ISMS reflects real obligations rather than a generic template. See ISMS scope.
Read more
Related terms
- ISMS scope
- The ISMS scope is the documented boundary of an information security management system: the parts of the organization, services, sites and systems it governs.
- Information security management system
- An information security management system is the set of policies, processes and responsibilities an organization uses to manage information security risk.
- Information security objectives
- Information security objectives are the measurable goals an organization sets for its ISMS, with owners, deadlines and a way to evaluate whether they are met.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.