Scope expansion after acquiring a payment-data subsidiary
Northwind Analytics is a 420-person SaaS provider whose ISMS scope, certified in 2019, states: 'the provision of analytics services from the London headquarters and the Slough data centre.' In March 2024 it acquired a 60-person fintech subsidiary in Dublin that processes payment data on a third-party cloud platform. The subsidiary has no ISMS and its CTO reports to Northwind's COO. Two enterprise customers now require evidence of ISO 27001:2022 certification covering 'all entities processing their data', and a new EU regulation applies to payment services. The compliance manager proposes adding the subsidiary to scope in time for the October 2025 transition audit, but the internal auditor warns that scope must reflect 'external and internal issues' and interested party requirements. The board wants a decision within four weeks, with no additional headcount and a fixed budget of £40,000.
1. Using clauses 4.1 and 4.2, explain what Northwind must analyse before deciding whether the Dublin subsidiary belongs in scope, and what evidence a transition auditor should expect.
Read the worked answer
Clause 4.1 requires the organisation to determine external and internal issues relevant to its purpose and that affect its ability to achieve intended ISMS outcomes. Externally, Northwind must analyse the EU payment-services regulation, customer contractual requirements, the cloud provider's jurisdiction and the sector threat landscape. Internally, it must consider group structure, the subsidiary's lack of an ISMS, shared services, culture, and the COO's span of control. Clause 4.2 requires identifying interested parties and their relevant requirements: enterprise customers, the payment regulator, subsidiary employees, the cloud provider and Northwind's board. The scope decision then follows from these inputs, not from a desire to avoid audit effort. If Dublin is excluded, the scope statement must still be accurate and the interfaces to in-scope services must be controlled, for example through supplier controls in A.5.19–A.5.22 and clause 8.1. Audit evidence should include a dated context analysis, an interested-party register with requirements, a documented scope rationale approved by top management, and records showing how the subsidiary's cloud processing is either included or controlled as an outsourced process. The key judgement is that scope is a risk-based decision that must be defensible, not a labelling exercise.
2. The compliance manager proposes adding the subsidiary with no new headcount and a £40,000 budget. Evaluate the feasibility and the risks of that plan, and state what transition activities are essential before any scope expansion is certified.
Read the worked answer
The proposal treats scope expansion as an administrative change. In practice, bringing a 60-person payment-data subsidiary into an ISMS requires a gap assessment, risk assessment and risk treatment, a revised SoA, competence and awareness for subsidiary staff, supplier and cloud controls, internal audit coverage, management review and correction of findings - all before the certification audit. With no dedicated headcount and £40,000, the likely failure mode is a scope statement that outruns the evidence, producing major nonconformities and an unreliable certificate. The judgement call is between three options: (1) include Dublin and resource the work properly, possibly using group resources and a phased plan; (2) keep Dublin outside scope but control the interface as an outsourced process, with contractual security requirements and monitoring; or (3) delay the transition date for the expanded scope. Commercial pressure from customers does not override the need for an accurate scope. Essential activities are a documented scope decision, updated context and interested parties, subsidiary risk assessment, SoA entries for cloud and payment controls, internal audit of the subsidiary, and management review. If the budget cannot cover these, the honest decision is to defer expansion rather than certify unsupported scope.