Does it apply to my organisation?
Only if a contract, a scheme, a regulator or your own policy points at it. The standard binds nobody by itself. It applies in practice when you run an entity authentication mechanism and something you are held to names the standard or the mechanism family.
When it applies
Only if a contract, a scheme, a regulator or your own policy points at it. The standard binds nobody by itself. It applies in practice when you run an entity authentication mechanism and something you are held to names the standard or the mechanism family.
When it does not
Only if a contract, a scheme, a regulator or your own policy points at it. The standard binds nobody by itself. It applies in practice when you run an entity authentication mechanism and something you are held to names the standard or the mechanism family.
What to record either way
Only if a contract, a scheme, a regulator or your own policy points at it. The standard binds nobody by itself. It applies in practice when you run an entity authentication mechanism and something you are held to names the standard or the mechanism family.
Questions
We are certified to ISO/IEC 27001. Does that make it mandatory?
No. The management system standard requires you to choose controls. This part can inform the choice, but it is not the control itself.
Our vendor cites it. Does that bind us?
Only through the contract or the scheme that names it. Ask the vendor which clause and which edition.
Not legal advice; does not certify. The full record is at the requirement record.