Scope and information security risks
Define information, activities and sites before choosing controls.
ISO/IEC 27001 · Information security
Information security is a system of decisions.
ISO/IEC 27001:2022 establishes requirements for an information security management system. The organisation defines its scope, assesses risks, determines treatment and reviews whether the system works. Technical controls matter, but their presence alone does not demonstrate effective management. An audit examines how information security responsibilities, risk decisions and operational evidence connect with the organisation's activities. It asks whether the system can be explained and supported when a customer, incident or change tests it.
Discuss ISO/IEC 27001
What to examine in the system
From intent to evidence.
Treatment and the Statement of Applicability
Link treatment decisions to risks and explain the controls selected.
Operational evidence and management review
Examine records of incidents, access reviews, audits and improvement.
Make the boundaries clear
A useful scope explains which activities and information the management system covers, including its interfaces and dependencies. It enables readers of a certificate to understand what has been evaluated. Cloud services, remote work and external providers require attention to responsibilities and evidence; a provider's certificate does not explain every part of a customer's own system.
Follow the risk decisions
Examine how risks are identified, evaluated, assigned and treated. The Statement of Applicability should connect the selected controls with the organisation's reasoning and implementation. A generic document weakens that connection. Evidence can include access decisions, incident investigations, recovery exercises and supplier reviews, selected according to the scope and risks rather than collected as an indiscriminate checklist.
Look for review and improvement
Records become useful when they lead to decisions. Ask what management learned from incidents, audits, performance information and changes in context. Follow corrective actions through to an evaluation of their effectiveness. For certification, G-CERTI's institutional team reviews the requested scope and route. For training, review the specific programme and entry requirements through the official channel.
Evidence worth collecting
- A defined scope connected with activities, locations, information and dependencies.
- Risk assessment criteria, identified risks and treatment decisions with accountable owners.
- A Statement of Applicability supported by reasons and evidence of implementation.
- Records of access reviews, incidents, monitoring, tests and relevant supplier oversight.
- Internal audit, management review and corrective action records that show follow-through.
A first review
Where should you start?
Select the areas you can already support with records. You will get a list of review priorities.
Questions that matter
Does ISO/IEC 27001 guarantee that there will be no incidents?
No. It provides requirements for managing information security within a defined scope. A certificate is not a promise of zero risk or uninterrupted protection.
What is the Statement of Applicability?
It documents the necessary controls and the justification for their inclusion, whether they are implemented, and the justification for excluding Annex A controls. It should be consistent with risk treatment.
Is a collection of cybersecurity tools enough?
Tools can support controls. The organisation also needs a coherent management system with scope, responsibilities, risk decisions, operation, evaluation and improvement.
How do I request a certification proposal?
Describe the organisation, activities, locations, intended scope and any current certificate. G-CERTI's institutional team confirms the applicable process and prepares the proposal.
Sources to verify
ISO/IEC 27001 · Información oficial de ISO ISO/IEC 27001:2022 · Catálogo oficial de ISOSources reviewed on 12 October 2026.
A conversation, a next step
Let’s discuss what matters.
Let’s talkMedia and other inquiries: contact@fernandoarrieta.org