Integrated management systems · Basic · 12 min lesson
ISMS foundations - context, scope, leadership and the CIA triad
ISO/IEC 27001:2022 with Amendment 1:2024 - clauses 4 and 5
What you will learn
- Explain what an information security management system is and describe confidentiality, integrity and availability with medical-device examples.
- Describe how clauses 4.1 to 4.4 set context, interested parties, scope and the ISMS, including the climate change question added by Amendment 1:2024.
- State what leadership, the policy and defined roles must show under clauses 5.1 to 5.3, and spot a weak scope or policy.
Key takeaways
- An ISMS is a systematic, risk-based way to protect information across people, processes and technology.
- The CIA triad is confidentiality, integrity and availability; in medical software integrity and availability can affect patients.
- Clauses 4.1 and 4.2 cover context and interested parties; Amendment 1:2024 adds the question whether climate change is relevant.
- Clause 4.3 scope sets the boundary and decides what a certificate covers.
- Clause 5 requires visible top management leadership, a communicated policy and named roles for conformity and reporting.
Free practice question
Brenvik Diagnostics, a fictional maker of cloud-based lab software, wrote its ISMS scope as 'the IT department and the office server room'. The product engineers and the production database in a cloud account are not mentioned.
What is the main weakness?
The scope ignores where the information actually lives, so it does not reflect the issues, requirements and interfaces of the organisation.
Correct. Clause 4.3 requires the scope to consider the issues of clause 4.1, the requirements of 4.2 and interfaces; leaving out engineers and cloud data defeats that purpose.
The scope is too wide because server rooms should never be included.
Not quite. Clause 4.3 sets no rule against server rooms; the problem is that the scope is too narrow for the real information.
The scope is acceptable because ISO/IEC 27001 only applies to IT departments.
Not quite. The standard applies to the organisation's information wherever it sits; clause 4.3 does not limit it to the IT department.
The scope should be kept secret from auditors until the audit day.
Not quite. Clause 4.3 requires the scope to be available as documented information, so hiding it from auditors contradicts the standard.
Key terms
- ISMS: Information security management system: the policies, processes and controls an organisation uses to manage information security risk.
- CIA triad: Confidentiality, integrity and availability: the three properties of information that security protects.
- interested party: A person or organisation that can affect or be affected by the ISMS, such as customers, regulators or suppliers.
- scope: The documented boundary of the ISMS, set under clause 4.3.
- top management: The person or group that directs and controls the organisation at the highest level.
- Amendment 1:2024: Short 2024 change to ISO/IEC 27001:2022 adding the climate change question to clauses 4.1 and 4.2.
Official sources
- ISO/IEC 27001:2022 - Information security management systems
- ISO/IEC 27002:2022 - Information security controls
- ISO 27001 Amendment 1: Climate Change (summary)
- ISO 27001:2022 and the October 2025 transition deadline (Secureframe)
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.