Guest post Created: Jan 13, 2016 Last commented: Jan 13, 2016

Software developmnet within the company

Our company sells software we develop ourselves. Development is done within a separate system and is managed by its own policies, procedures, and has its own set of (security) requirements. Do we need to include these policies, procedures and requirements into the ISMS? I prefer to exclude this from the ISMS scope, because we dont use this software in our oown production environment and the requirements are customer specific. Thanks.

0 0

Assign topic to the user

Select user

Guest

AntonioS Jan 13, 2016

You can exclude the development in your ISMS scope. From my point of view, you have focused the scope in the production environment, and it is not mandatory to include also the development (although can be recommendable to include it in the future, integrating existing policies, procedures, etc. with the documentation of the ISMS). Anyway, if you need more information about the definition of the scope, you can read this article "How to define the ISMS scope" : https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope

Quote

0 0

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

Jan 12, 2016

Expert Advice Community