Academy module 1 · ISO/IEC 27001 · Lesson 1 of 8
Define the ISMS context and scope
About 12 minutes · Introductory draft · Checked 2026-10-24
AI-authored and AI editorially reviewed; independent review pending. Read course scope and remaining gaps.
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: A boundary must follow the service and its dependencies.
Explore the anchors
Understand the organization and interested parties.
Concept matching activity
Match this task or description to its concept:
Define included services interfaces and locations.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What you will learn
- Understand the organization and interested parties.
- Define included services interfaces and locations.
- Identify shared systems and suppliers.
Concepts and distinctions
An information security management system connects decisions, people, processes and evidence around information risk. Start with the service being protected: who uses its information, what outcomes depend on it and which obligations apply. An ISMS is broader than a firewall installation or an IT department. Paper records, staff actions, outsourced services and management decisions can all affect information security.
A useful scope names activities and boundaries clearly enough that another person can identify what is included. Excluding a corporate function from the stated boundary does not make a dependency disappear. Record interfaces with shared identity services, hosting, support and suppliers. The 2024 climate-action amendment requires attention to climate relevance within organizational context; it does not automatically require every organization to buy a particular environmental control.
Apply the process and collect evidence
Build a service map before drafting the scope statement. List interested parties, information flows, owners, facilities and external dependencies. Record how applicability and context are reviewed after organizational changes. Treat the scope statement as a maintained decision with supporting evidence, not a marketing sentence. Use the licensed standard to confirm exact requirements and applicable amendment wording.
ISMS foundations and management-system integration
An asset is something of value, including information, services, relationships and physical equipment. Describe its owner, dependencies and required confidentiality, integrity and availability before selecting controls. Security protects information against inappropriate disclosure, change or loss of use; privacy also asks whether processing is appropriate for the people affected. Active attacks change or disrupt a system, while passive observation seeks information without necessarily changing the target. Both need scenario-specific evidence.
Use a SWOT exercise to identify internal strengths and weaknesses and external opportunities and threats, then translate relevant observations into explicit ISMS risks or improvement actions. SWOT alone is not a risk assessment. A process approach connects inputs, activities, owners, outputs and feedback; Plan-Do-Check-Act supports repeated improvement. An integrated management system may share document control and review processes while retaining each standard’s distinct requirements. ISO/IEC 27001 specifies ISMS requirements; ISO/IEC 27002 provides control guidance and ISO/IEC 27005 supports information-security risk management. These documents have different purposes.
Work through a scenario
Fictional facts for learning. This exercise is not scored.
A fictional learning provider scopes its learner portal but proposes excluding the shared identity service because another team operates it. A regional heat event also disrupts the hosting supplier.
Compare your reasoning
The portal depends on identity and hosting even when those teams sit outside the organizational scope. Document interfaces, responsibilities and risks. Assess whether climate-related disruption is relevant to the service context, then select justified responses; a supplier incident alone does not prescribe one universal control.
Remember
- A boundary must follow the service and its dependencies.
- Understand the organization and interested parties.
- Identify shared systems and suppliers.
Orientation and further reading
- ISO: ISO/IEC 27001:2022 with Amd 1:2024 context
- ISO: guidance for auditing management systems (public overview)
Original examples and explanations. Background references do not establish complete exam coverage.
Try ISO/IEC 27001 practice questions · Report a content correction