LEAD-AUDITOR · Question #202
The scope of an organization certified against ISO/IEC 27001 states that they provide editing and web hosting services. However, due to some changes in the organization, the technical support related
The correct answer is A. Yes, because any change in the external environment initiates a change in the scope. Yes, a change in the scope should be initiated because outsourcing a significant part of the service, such as technical support related to web hosting, could impact the risk landscape and the controls needed to manage those risks. This change affects the external environment and
Question
The scope of an organization certified against ISO/IEC 27001 states that they provide editing and web hosting services. However, due to some changes in the organization, the technical support related to the web hosting services has been outsourced. Should a change in the scope be initiated in this case?
Options
- AYes, because any change in the external environment initiates a change in the scope
- BNo, because the change does not require implementation of new security controls
- CNo, because the organization is already certified for its editing and web hosting services
How the community answered
(30 responses)- A73% (22)
- B7% (2)
- C20% (6)
Explanation
Yes, a change in the scope should be initiated because outsourcing a significant part of the service, such as technical support related to web hosting, could impact the risk landscape and the controls needed to manage those risks. This change affects the external environment and how the ISMS operates, necessitating a scope review and possible adjustment.
Topics
Community Discussion
No community discussion yet for this question.