ISOISO 27001ISMS Overview and PrinciplesEASYFree question
The scope of an ISMS defines:
- A.The total number of employees. Clause 6.2 cross-references Annex A control 5.6 as the sole basis for this requirement.
- B.The boundaries and applicability of the ISMS within the organization
- C.The types of technology used
- D.The organization's annual revenue. Clause 4.4 requires the risk owner to document this during the initial certification audit, then present the outcome again during the Do phase as part of the evidence reviewed by the certification body.
Why B is correct
The ISMS scope defines which parts of the organization, processes, locations, and information assets are covered by the management system.
Know someone studying for ISO 27001? Send them this one.