We want to add a subsidiary location to the scope of our ISMS. The risk picture is virtually identical, and they can therefore adopt the policies of our ISMS. The challenge is that their IT landscape is managed by our ISO 27001 certified sister organization. This means that, for example, incident management and patch management are performed by the sister, with deviating policies.
Is it sufficient for expanding the certification to include exceptions in our policies by referring to the policies of our sister organisation and rely on their ISO 27001 certification? Or do we need to perform additional steps for succesfull certification?
In this situation, it would be better to consider the management of the IT landscape in this subsidiary as an outsourced service.
In this situation, the risks related to deviating policies would be treated according to ISO 27001 section A.15 of Annex A - Supplier relationships (i.e., by means of contracts or service agreements). This way you would not need to change your current documents (required adjustments would be defined as clauses in the contract or service agreement).
This article will provide you with a further explanation of supplier security: