You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. You find all nursing home residents wear…

B . This clause requires the organisation to determine the interested parties that are relevant to the

ISMS, and the requirements of these interested parties12. This clause is relevant to the verification of

the scope of the ISMS because it helps the organisation to identify the stakeholders that have an

influence or an interest in the information security of the organisation, such as customers, suppliers,

regulators, employees, etc. The organisation should also consider the needs and expectations of

these interested parties when defining the scope of the ISMS, and ensure that they are met and

communicated.

E . This clause requires the organisation to establish an information security policy that provides the

framework for setting the information security objectives and guiding the information security

activities13. This clause is relevant to the verification of the scope of the ISMS because it helps the

organisation to define the direction and principles of the ISMS, and to align them with the strategic

goals and context of the organisation. The information security policy should also be consistent with

the scope of the ISMS, and should be communicated and understood within the organisation and by

relevant interested parties.

F . This clause requires the organisation to determine the internal and external issues that are

relevant to the purpose and the context of the organisation, and that affect its ability to achieve the

intended outcomes of the ISMS14. This clause is relevant to the verification of the scope of the ISMS

because it helps the organisation to understand the factors and conditions that influence the

information security of the organisation, such as the legal, technological, social, economic,

environmental, etc. The organisation should also monitor and review these issues, and consider

them when defining the scope of the ISMS.

H . This clause requires the organisation to determine the boundaries and applicability of the ISMS to

establish its scope15. This clause is relevant to the verification of the scope of the ISMS because it

helps the organisation to describe the information and processes that are included in the ISMS, and

to document the scope in a clear and concise manner. The organisation should also consider the

issues, requirements, and interfaces identified in clauses 4.1, 4.2, and 4.3 when determining the

scope of the ISMS, and ensure that the scope is appropriate to the nature and scale of the

organisation.

Reference:

1: PECB Candidate Handbook - ISO 27001 Lead Auditor, page 17 2: ISO/IEC 27001:2022 - Information

technology — Security techniques — Information security management systems — Requirements,

clause 4.2 3: ISO/IEC 27001:2022 - Information technology — Security techniques — Information

security management systems — Requirements, clause 5.2 4: ISO/IEC 27001:2022 - Information

technology — Security techniques — Information security management systems — Requirements,

clause 4.1 5: ISO/IEC 27001:2022 - Information technology — Security techniques — Information

security management systems — Requirements, clause 4.3