Docs

Appearance

ISO/IEC 27001:2022 — ISMS scope, Statement of Applicability, and certification ​

ISO/IEC 27001:2022 gives its requirements to the organization that operates an information security management system (ISMS). This page gives two of these requirements: the scope of the ISMS (Clause 4.3) and the Statement of Applicability (Clause 6.1.3 d)). It also gives information about certification by a certification body. A certification body audits the ISMS, but the standard gives no requirements to the certification body. For the documented information that each clause requires, see Documented information in Clauses 4 to 10.

The scope of the ISMS (Clause 4.3) ​

ISO/IEC 27001 Clause 4.3 requires the organization to determine the boundaries and applicability of its ISMS. These boundaries and this applicability set the scope of the ISMS. When the organization determines the scope, it must consider all of these items:

  • a) the external and internal issues that it determines in Clause 4.1
  • b) the requirements of interested parties that it determines in Clause 4.2
  • c) the interfaces and dependencies between the work that the organization does and the work that other organizations do.

The scope must be available as documented information.

Clause 4.3 does not give the items that the scope must contain, for example functions, locations, processes, information systems, or assets. It also does not tell the organization how to write the scope. If the scope names such items, that is a decision of the organization.

Item c) requires the organization to consider interfaces and dependencies. It does not require the organization to name them in the scope. Item c) is about the interfaces and dependencies between the work that the organization does and the work that other organizations do. The work of the organization includes the work in the scope and the work that is not in the scope.

ISO/IEC 27001 has one ISMS for the organization, in the scope that the organization determines (Clauses 4.3 and 4.4). The standard has no ISMS scope for each AI system and does not divide the ISMS into levels. The scope that the organization determines shows if the information of an AI system is in the ISMS. Modulos recommends that you add the AI System Framework MFF-9 to each AI System with information in the ISMS scope (Recommended AI System structure).

Clause 4.3 does not tell the organization when to examine the scope again. For changes to the ISMS and for the management review inputs that can change the scope, see Clauses 6.3 and 9.3.

The Statement of Applicability (Clause 6.1.3 d) ​

ISO/IEC 27001 Clause 6.1.3 requires the organization to make a process for information security risk treatment and to apply it. Item d) of this process requires the organization to make a Statement of Applicability. The Statement of Applicability must contain these four items:

  1. The necessary controls that the organization determines in Clause 6.1.3 b) and c).
  2. The justification to include these controls.
  3. For each necessary control, if the organization implements it or not.
  4. The justification for each Annex A control that the organization excludes.

Clause 6.1.3 b) requires the organization to determine the necessary controls. The organization can make these controls or use controls from a source that it selects (NOTE 1 to Clause 6.1.3). Clause 6.1.3 c) requires the organization to compare them with Annex A and to make sure that no necessary control is missing (How Annex A applies through risk treatment).

The Statement of Applicability comes after the risk assessment. Clause 6.1.3 a) requires the organization to select "appropriate" risk treatment options. When it selects them, it must consider the results of the risk assessment (Clause 6.1.2). The necessary controls are the controls for these risk treatment options (Clause 6.1.3 b)). The Introduction of the standard (0.1) tells you that the sequence of the requirements in the standard is not a sequence of implementation. For the risk assessment and risk treatment processes, with the risk treatment plan and the approval of the risk owners, see Clause 6 (Planning).

The Statement of Applicability is one of many requirements. If an organization claims conformity to ISO/IEC 27001, it cannot exclude a requirement of Clauses 4 to 10 (Clause 1). Clause 6.1.3 also requires the organization to retain documented information about the risk treatment process.

Clause 6.1.3 d) gives no other items. The organization can add other data for each control. Examples are the function that operates the control, the location of the evidence, and the date when the organization will implement the control. Values such as "planned" or "in progress" are also data that the organization can add. This other data is a decision of the organization. It is not an item of Clause 6.1.3 d).

ISO/IEC 42001:2023 Clause 6.1.3 f) also requires a statement of applicability. This clause does not require the statement of applicability to show if the organization implements each control (ISO/IEC 27001 and ISO/IEC 42001).

The certification audit cycle ​

ISO/IEC 27001 is a voluntary standard. It contains no provision about certification, and it sets no procedure for certification. Certification is optional for an organization that implements it (ISO catalog page). The standard requires an ISMS in conformity with its requirements, not a certificate.

A certification body audits the ISMS of the organization and can then certify it. The ISO catalog page gives this information: a certificate from an accredited certification body "may bring an additional layer of confidence". ISO/IEC 27006-1:2024 gives requirements for certification bodies that audit and certify an ISMS to ISO/IEC 27001, and these requirements add to ISO/IEC 17021-1 (ISO catalog page).

In management system certification in general, IAF MD 5:2023 gives this cycle:

  • an initial certification audit in two parts, Stage 1 and Stage 2
  • surveillance audits during the initial three-year certification cycle, with surveillance audit time each year
  • a recertification audit.

IAF MD 5:2023 is for quality, environmental, and occupational health and safety management systems. It gives no audit time for an ISMS.

ISO/IEC 27001 sets no time to certification and no minimum period of operation before an audit. The certification body prepares its audit plan. Speak to the certification body to get its audit plan. The organization, not the certification body, determines the necessary controls and makes the Statement of Applicability (see The Statement of Applicability (Clause 6.1.3 d)).

ISO/IEC 27001 requires internal audits and management reviews at planned intervals that the organization sets (Clauses 9.2.1 and 9.3.1). These internal audits are not the audits of the certification body. For these intervals, see When to do the risk assessments, audits, and reviews again.

The Requirements in Modulos ​

Modulos gives ISO/IEC 27001 as two Frameworks with the name ISO 27001: OFF-9 at the Organization level and MFF-9 at the AI System level (ISO/IEC 27001:2022 in Modulos). In OFF-9, the Requirement ORF-198 is for Clause 4.3. The Requirement ORF-205 is for Clause 6.1.3, with the Statement of Applicability of Clause 6.1.3 d). The organization makes the Statement of Applicability. For all Requirements and their provisions, see The Requirements.

No Requirement of OFF-9 or MFF-9 is for certification. The selection of a certification body and the certification audits are work that the Frameworks do not hold.

Where to go next ​

ISO/IEC 27001 overview

The standard, its edition and structure, certification, and use with ISO/IEC 42001 and ISO/IEC 27701

Clauses 4 to 10

The requirements of Clauses 4 to 10, with risk assessment and risk treatment in Clause 6

Annex A

The 93 controls in four themes, and how they apply through Clause 6.1.3

Integration with AI governance

ISO/IEC 27001 with ISO/IEC 42001, and where the EU AI Act applies

Operationalizing in Modulos

The steps to set up OFF-9 and MFF-9. The Requirements, with their provisions.

Sources of this page ​

  • ISO/IEC 27001:2022 (edition 3, 2022-10, ISO catalog page), Information security, cybersecurity and privacy protection — Information security management systems — Requirements: Introduction 0.1, Clauses 1, 4.3, 4.4, 6.1.2, 6.1.3 (NOTE 1 to NOTE 3), 9.2.1, and 9.3.1, and Annex A.
  • ISO/IEC 42001:2023, edition 1, 2023-12. Clause 6.1.3 f).
  • ISO/IEC 27006-1:2024, edition 1, 2024-03 (ISO catalog page).
  • IAF MD 5:2023, Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems, Issue 4, Version 3, 14 June 2023. Clauses 0.1, 0.3, 0.5, 5, and 6 (IAF).

Disclaimer

This page gives general information only. It is not legal advice. It does not replace the audit of a certification body.