You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. You find all nursing home residents wear…

According to ISO 27001:2022 clause 4.3, the organisation shall determine the scope of the

information security management system (ISMS) by considering the internal and external issues, the

requirements of interested parties, and the interfaces and dependencies with other organisations12

In this case, the ISMS scope covers an outsourced data center that hosts the artificial intelligence (AI)

cloud server for healthcare monitoring and analysis of the residents’ data. Therefore, the audit

evidence you need to find to verify the scope of the ISMS should include:

The auditee has identified the governmental authorities’ needs and expectations on healthcare

services and patient data handling. This is an external issue and an interested party requirement that

affects the ISMS scope, as the auditee has to comply with the relevant laws and regulations regarding

the quality, safety, and privacy of healthcare services and patient data12

The auditee has identified the resident’s needs and expectations on how they should protect the

resident’s personal data. This is an external issue and an interested party requirement that affects

the ISMS scope, as the auditee has to ensure the confidentiality, integrity, and availability of the

resident’s personal data that is collected, processed, and stored by the electronic wristband and the

AI cloud server12

The IT service agreement with the data center where the artificial intelligence (AI) cloud server is

located. This is an interface and dependency with another organisation that affects the ISMS scope,

as the auditee has to control the externally provided processes, products, and services that are

relevant to the ISMS, and to implement appropriate contractual requirements related to information

security12

The following options are not relevant or sufficient for verifying the scope of the ISMS:

The auditee has identified the resident’s needs and expectations on the facility and environmental

safety. This is an external issue and an interested party requirement, but it does not affect the ISMS

scope, as it is not related to information security12

The auditee has ISO 9001 certification. This is an indication of the auditee’s quality management

system, but it does not verify the scope of the ISMS, as it is not related to information security12

The auditee has identified the resident’s needs and expectations on the comfort facility, medical

professional’s competence, and clean environment. These are external issues and interested party

requirements, but they do not affect the ISMS scope, as they are not related to information

security12

The auditee has identified the resident’s needs and expectations on healthcare medical treatment

services. These are external issues and interested party requirements, but they do not verify the

scope of the ISMS, as they are not specific to information security12

The auditee is considering the purchase of a healthcare monitoring app from an external software

company. This is a potential change that may affect the ISMS scope in the future, but it does not

verify the current scope of the ISMS, as it is not yet implemented or controlled12

Reference:

1: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Course by CQI and

IRCA Certified Training 1 2: ISO/IEC 27001 Lead Auditor Training Course by PECB 2