We have started engaging with a company to help us to get ISO 27001 certificate and I am the project manager or the contact person and I am confused about the SOW, they want to do for all the *** and I believe that we have to start with the IT department. What do you think?
Some information is missing for providing a direct answer, so I’ll provide one considering two possible scenarios.
The definition of the Scope of Work (SOW) of your ISO 27001 project will depend on the Information Security Management System (ISMS) scope, which basically defines where the information you want to protect is.
For small organizations (up to 50 employees) is more practical to include all organization in the scope, because the effort to keep a separation between the parts in and out od the scope is not worthy. In this case, the project’s SOW should be all organization.
In case your organization has more than 50 employees, you should evaluate if keeping only the IT department in the scope is worthy (you would have to treat all other departments like external parties, for which you need to implement controls to separate them from the ISMS scope, at the same time you need to provide access to information in the ISMS scope they need to operate). In this case, the project’s SOW should be defined according to the ISMS scope.
This problem is described in detail in this article:
All departments included in the ISMS scope need to be involved in the risk assessment.
Regarding risk owners, you should consider the roles with the most interest and authority to treat them. For example, in case you identify risks related to a server, you should consider as the risk owner the IT manager.
These articles will provide you a further explanation about risk assessment and risk owners: