Academy learning group 1 · Academy module (not an ISO clause) M01 · Chapter 1 of 8
Define the ISMS context and scope
About 6 minutes · ISO/IEC 27001:2022 with Amd 1:2024 context
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: A boundary must follow the service and its dependencies.
Explore the anchors
Understand the organization and interested parties.
Concept matching activity
Match this task or description to its concept:
Define included services interfaces and locations.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and distinctions
- Apply the process and collect evidence
- ISMS foundations and management-system integration
Concepts and distinctions
An information security management system connects decisions, people, processes and evidence around information risk. Start with the service being protected: who uses its information, what outcomes depend on it and which obligations apply. An ISMS is broader than a firewall installation or an IT department. Paper records, staff actions, outsourced services and management decisions can all affect information security.
A useful scope names activities and boundaries clearly enough that another person can identify what is included. Excluding a corporate function from the stated boundary does not make a dependency disappear. Record interfaces with shared identity services, hosting, support and suppliers. The 2024 climate-action amendment requires attention to climate relevance within organizational context; it does not automatically require every organization to buy a particular environmental control.
Apply the process and collect evidence
Build a service map before drafting the scope statement. List interested parties, information flows, owners, facilities and external dependencies. Record how applicability and context are reviewed after organizational changes. Treat the scope statement as a maintained decision with supporting evidence, not a marketing sentence. Use the licensed standard to confirm exact requirements and applicable amendment wording.
ISMS foundations and management-system integration
An asset is something of value, including information, services, relationships and physical equipment. Describe its owner, dependencies and required confidentiality, integrity and availability before selecting controls. Security protects information against inappropriate disclosure, change or loss of use; privacy also asks whether processing is appropriate for the people affected. Active attacks change or disrupt a system, while passive observation seeks information without necessarily changing the target. Both need scenario-specific evidence.
Use a SWOT exercise to identify internal strengths and weaknesses and external opportunities and threats, then translate relevant observations into explicit ISMS risks or improvement actions. SWOT alone is not a risk assessment. A process approach connects inputs, activities, owners, outputs and feedback; Plan-Do-Check-Act supports repeated improvement. An integrated management system may share document control and review processes while retaining each standard’s distinct requirements. ISO/IEC 27001 specifies ISMS requirements; ISO/IEC 27002 provides control guidance and ISO/IEC 27005 supports information-security risk management. These documents have different purposes.
| Concept | What to remember |
|---|---|
| Context | Understand the organization and interested parties |
| Scope | Define included services interfaces and locations |
| Dependencies | Identify shared systems and suppliers |
Worked example
A fictional learning provider scopes its learner portal but proposes excluding the shared identity service because another team operates it. A regional heat event also disrupts the hosting supplier. The portal depends on identity and hosting even when those teams sit outside the organizational scope. Document interfaces, responsibilities and risks. Assess whether climate-related disruption is relevant to the service context, then select justified responses; a supplier incident alone does not prescribe one universal control.
Check your understanding
An organization excludes its shared login platform from the ISMS service map. What is the best correction?
Show explanation
Document the dependency and its responsibilities even if the operating team is outside scope. A service boundary must account for interfaces that affect its security.
Source and study boundary
Official standard overview. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.