You are performing an ISMS audit at a residential nursing home called ABC that provides healthcare services. You find all nursing home residents wear…

Verifying the ISMS scope requires an auditor to examine the inputs and processes the organization used to define it. Clause 4.1 (Context) and Clause 4.2 (Interested Parties) are fundamental inputs. Clause 4.3 is the direct requirement for determining and documenting the scope itself, including its boundaries and interfaces (like the outsourced cloud server). Given the healthcare data, legal and regulatory requirements (referenced in option C and required by Clause 4.2) are a critical driver for defining the scope's boundaries and are therefore directly relevant to its verification.

A. Organizational roles and responsibilities (Clause 5.3) define who manages the ISMS, not what the ISMS covers (its scope).
D. Awareness and training (Control A.6.3) is a control implemented within the defined scope, not a factor in verifying the scope itself.
E. The Policy (Clause 5.2) is created to be consistent with the scope; it does not define or verify the scope.
G. Working in secure areas (Control A.7.6) is a physical control applied within the scope, not used to verify the scope's definition.

1. ISO/IEC 27001:2022, Clause 4.1, "Understanding the organization and its context". This is the starting point for determining scope.

2. ISO/IEC 27001:2022, Clause 4.2, "Understanding the needs and expectations of interested parties". This clause requires identifying requirements, including legal and regulatory ones, which inform the scope.

3. ISO/IEC 27001:2022, Clause 4.3, "Determining the scope of the information security management system". This is the primary clause an auditor would use to verify the documented scope and the considerations made (e.g., interfaces and dependencies with the cloud provider).

4. Fomin, V. V., de Vries, H. J., & Barlette, Y. (2008). ISO/IEC 27001 information systems security management standard: exploring the reasons for low adoption. In Third European Conference on Information Management and Evaluation (p. 159). This paper discusses the challenges of ISMS implementation, highlighting the criticality of correctly defining the scope based on organizational context and boundaries (p. 162).