Scope boundary, colocation and an acquired subsidiary
Northwind Diagnostics is a 520-person manufacturer of laboratory analysers. Its ISMS scope statement reads: 'Design, manufacture, sales and support of analysers; Northwind House, Cambridge.' Production planning and the customer service platform run on an ERP hosted in a colocation cage in Amsterdam operated by CanalData. Northwind's own infrastructure team administers the ERP remotely and CanalData provides power, cooling and physical access control under a contract that cites its ISO/IEC 27001 certificate. Eighteen months ago Northwind acquired a 60-person software maintenance company, LabSoft, which still operates its own ticketing system and has read-only VPN access to the Cambridge service platform. The scope statement does not mention Amsterdam or LabSoft. The IT director tells you, as internal auditor, 'CanalData is certified, so that's covered, and LabSoft is out of scope until integration finishes next year.' The audit programme has 4 days allocated for this scope review.
1. Assess whether the scope statement satisfies ISO/IEC 27001 clause 4.3. Identify the specific gaps and state whether the situation warrants a nonconformity, and if so, at what grade.
Read the worked answer
Clause 4.3 requires the scope to define boundaries and applicability, and to consider external and internal issues, interested-party requirements, and interfaces and dependencies. Two gaps are evident.
First, the Amsterdam cage hosts the ERP that supports production planning and customer service, both inside the declared business scope. Outsourcing does not remove the process from the ISMS: Northwind must govern the relationship through contract terms, access control, incident reporting, monitoring and exit arrangements, and the scope must record the interface. CanalData's own certificate is relevant evidence about the provider, not evidence that Northwind's controls over the service are effective. Second, LabSoft performs software maintenance for in-scope products and has VPN access into the service platform. Even if integration is incomplete, the interface and shared access fall within the system boundary unless a documented, risk-based justification and controls exist.
Because the omission concerns a core production platform and a connected entity, an auditor cannot conclude that the ISMS covers all activities within the intended boundary. I would raise a nonconformity against 4.3 and grade it major: the scope statement is not credible and prevents assurance. Supplier certification and future integration plans are not acceptable justifications.
2. What audit evidence would you collect to resolve the boundary question, and how would you handle the audit if management refuses to change the scope?
Read the worked answer
Evidence would include the current scope document and its approval; risk assessment and Statement of Applicability entries for the ERP, colocation and LabSoft; the CanalData contract and SLA; CanalData's ISO/IEC 27001 certificate and SOC 2 report, including their stated scope; network and data-flow diagrams; asset inventory entries for the Amsterdam cage; access logs and access-review records for CanalData and LabSoft VPN accounts; supplier monitoring minutes; and incident and change records involving the provider. I would interview IT operations, procurement, the LabSoft service owner and top management, then test a sample of access reviews and changes to confirm Northwind actually operates the controls it claims.
If management refuses to amend the scope, I would not silently audit only Cambridge. I would document the limitation, explain that no assurance can be given over the excluded core platform, and escalate to top management and the audit committee under the internal audit charter. The report should distinguish 'not audited' from 'conforms'. I would also check whether the certification body was informed of the acquisition and hosting arrangement, because that affects the external certificate and management's own claims.