ISO 27001 Across Industries: Change the Scope, Risk and Evidence

ISO/IEC 27001 is not an IT-industry standard. It can be applied by organisations of different sizes, sectors and operating models because it specifies how to manage information-security risk rather than prescribing one technology stack.

What changes across industries is not the standard’s core management-system logic. Scope, information, obligations, threats, dependencies, risk criteria, selected controls and evidence change. A hospital, bank, manufacturer, government body and software provider should not end up with identical ISMS designs.

Information protection extends beyond IT companies. This guide turns that principle into sector-specific scoping and audit decisions without repeating dated regulatory claims.

The standard is adaptable, not vague

The official ISO 27001 overview states that the standard is suitable for organisations of any size and sector. Adaptability comes from risk-based decisions and a defined ISMS scope.

Every organisation still needs to establish the management system: understand context and interested parties, define scope, assign leadership, assess and treat risk, provide support, operate controls, evaluate performance and improve. Sector differences influence how those requirements are fulfilled.

Read what an ISMS actually does for the underlying management cycle.

Six questions that change by industry

1. What information creates value or harm?

A technology provider may prioritise customer tenant data, source code and service telemetry. A hospital handles clinical records and care-related availability. A manufacturer protects engineering data, recipes, production parameters and operational technology. Government bodies may hold identity, policy and public-service information.

Include information in paper, verbal and physical forms where relevant. Do not reduce the inventory to databases.

2. Which services and outcomes depend on it?

Map information to business and public outcomes. Loss of a collaboration system may be inconvenient for one entity but may interrupt clinical coordination or field operations in another.

Scope decisions should make these service connections visible. The ISO 27001 scope boundaries guide explains how to document interfaces and exclusions.

3. Which obligations apply?

Legal, regulatory, contractual and professional requirements vary by jurisdiction and role. ISO 27001 helps manage applicable obligations, but certification does not replace a regulator’s assessment or establish compliance with every law.

Record the requirement, applicability rationale, owner, implementation mechanism and review trigger. Legal interpretation should be owned by qualified specialists.

4. What threatens the sector’s information and operations?

Threats may include cyberattack, insider action, fraud, equipment failure, physical intrusion, supply disruption, human error, environmental events or loss of specialist staff. Their likelihood and consequence vary by service and location.

Sector intelligence can inform assessment, but local exposure and control strength still matter.

5. Which dependencies concentrate risk?

Cloud platforms, payment networks, identity services, telecoms, utilities, laboratories, logistics partners and specialist maintainers can create shared failure paths. A supplier’s certificate is useful evidence only when its scope and service relationship match the dependency.

6. What evidence demonstrates operation?

Evidence should come from actual processes and systems. A software firm may sample deployment approvals and tenant isolation. A hospital may trace clinical access and downtime procedures. A manufacturer may test engineering workstation control and production recovery.

The audit method stays consistent—define population, sample risk, verify provenance, trace exceptions—while the records differ.

Sector patterns and evidence

Technology and SaaS

Typical risks involve multi-tenant data, privileged access, secure development, cloud configuration, availability and rapid change. Scope should connect product, platform, support, development and shared corporate services.

Useful evidence includes code review, deployment history, infrastructure configuration, vulnerability remediation, tenant access and incident records. The SaaS scope and shared-responsibility guide addresses cloud boundaries in detail.

Healthcare

Clinical information requires confidentiality and integrity, but availability can directly affect care. Scope may include clinical systems, connected devices, laboratories, facilities, identity, third parties and downtime operation.

Evidence includes role-based access, emergency access, device inventories, clinical-system changes, incident handling and tested fallback. Sector guidance can complement the ISMS; see ISO 27001 and ISO 27799 for healthcare.

Financial services

Important concerns include transaction integrity, fraud, privileged access, customer information, reporting, availability and outsourced services. Scope should reflect legal entities, critical processes, payment or trading interfaces, cloud services and shared group functions.

Evidence may include segregation decisions, access recertification, change controls, transaction monitoring, supplier assurance, resilience tests and regulatory mapping. An ISO certificate should not be presented as automatic financial-regulatory compliance.

Manufacturing and operational technology

Manufacturers depend on engineering knowledge, production systems, operational technology, quality records and supplier networks. Availability and safety interfaces may dominate treatment decisions.

Evidence includes network separation, remote maintenance approvals, engineering change, backup and recovery, physical access, removable-media control and incident coordination with safety teams. IT-only scope can be misleading if production dependencies remain outside without clear justification.

Government and public services

Government organisations may need to protect sensitive records while preserving transparency, lawful access and service availability. Scope can cross agencies, shared platforms, contractors and legacy systems.

Evidence includes information classification, authorisation, public-record handling, privileged access, supplier controls, incident escalation and continuity of citizen services. Public-sector security frameworks may add requirements beyond ISO 27001.

Professional and non-profit organisations

Smaller organisations still hold client, donor, employee and strategic information. Their controls can be proportionate: clear ownership, managed devices, secure cloud services, tested recovery and reliable supplier governance.

Complexity should follow risk, not headcount. A small specialist firm may hold information whose compromise has high consequence.

A repeatable sector-tailoring method

1. Define business and public outcomes.
2. Identify important information in all relevant forms.
3. Map systems, people, sites and suppliers supporting those outcomes.
4. Determine obligations and interested-party requirements.
5. Set impact criteria appropriate to sector consequences.
6. Assess credible risks and existing control strength.
7. Select treatments and explain Annex A applicability.
8. Define measures and evidence sources.
9. Audit across organisational and supplier boundaries.
10. Review changes in regulation, technology and service design.

Use the ISO 27001 readiness checker to identify management-system gaps, then interpret results in the organisation’s sector context.

Pass, partial and fail examples

Pass: the scope reflects important services, sector obligations and dependencies; risk criteria capture real consequences; selected controls are justified; and operating records come from the full population.

Partial: the ISMS is well organised but uses generic risks, excludes important shared services without analysis, or collects evidence that does not cover sector-specific operations.

Fail: certification is treated as an IT project, critical information and suppliers are omitted, or the same control set is copied from another industry without risk reasoning.

Audit questions for any sector

• Which sector outcome would be harmed by loss of confidentiality, integrity or availability?
• Why is each major boundary or exclusion defensible?
• Which obligations materially changed risk treatment?
• Where do safety, privacy, continuity or financial controls interact with the ISMS?
• What supplier failure could bypass internal controls?
• Which evidence population proves operation across the scope?
• What changed in the sector during the review period?
• How did management respond?

One standard, different evidence

ISO 27001 applies widely because information risk appears in every sector, not because every organisation should look the same. A credible ISMS preserves common management-system discipline while changing its boundary, treatment and evidence to fit the organisation.

The strongest certification scope is not necessarily the largest. It is the one stakeholders can understand, owners can operate, auditors can test and management can defend against real sector risk.