Entity and scope matrix
Describe included services, locations and interfaces. Identify shared functions, excluded activities and the evidence needed to explain the boundary to customers and auditors.
Shared services. Local responsibilities.
ISO 27001 consulting for European operations.
A group policy does not show which European entity operates a control or holds the evidence. CyberVantage360 helps organisations turn shared security expectations into a practical ISO 27001 programme. Give central and local teams clear responsibilities, a workable implementation plan and evidence that supports independent certification.
Start with the operating decision
Build one view of the services and their dependencies.
Start with the activities that customers and management expect the certificate to cover. Map the contracting entities, operating sites, information flows and shared platforms. A common identity service or security team can support several businesses without making their processes identical.
ISO/IEC 27001:2022 addresses information security management systems. ISO's current overview also lists its 2024 amendment. Establish the applicable standard basis with your programme and certification owners, then turn the intended boundary into responsibilities that people can operate.
An acquisition deserves particular attention. Identify which inherited systems remain separate, who owns their risks and how evidence is obtained during integration. A proposed future platform should not be used to describe controls that are not yet operating.
Europe context
Separate security evidence from transfer decisions.
The EDPB explains that GDPR conditions for international transfers apply alongside other processing obligations. An ISMS can organise useful facts about supplier access, data locations and technical controls; it does not select a legal transfer mechanism or settle every privacy question. Source: EDPB International data transfers.
Treat Europe as a set of actual operating locations rather than a single legal label. Ask privacy and legal owners to identify applicable duties for each relevant entity and service. Record their decisions in the obligations register, with responsibility for keeping them current.
For shared support outside the EEA, include administrative access and troubleshooting exports in discovery. The practical aim is a consistent account of how information moves, who authorises access and how local exceptions are reviewed.
Agreed outputs
Give the group a programme it can maintain.
Agree outputs around the entities and services in scope, with clear acceptance criteria for central and local owners.
Risk and treatment decisions
Assess material information risks with the people operating each service. Connect chosen controls and the Statement of Applicability to actual ownership and implementation status.
Common controls and local instructions
Define what central teams provide and what local teams must do. Make joining, leaving, supplier changes and incident escalation workable across organisational boundaries.
Evidence and review schedule
Organise records, internal audit coverage, management decisions and corrective actions. Avoid relying on one well-prepared site as a substitute for the rest of the intended scope.
Practical implementation
Use the next business change to test the boundary.
Select a service that depends on both shared and local teams. Follow an access request, a supplier issue and a recovery decision through the actual process. Where accountability becomes unclear, resolve it before writing a common procedure that would preserve the ambiguity.
Sequence implementation by dependency. Group technology changes, local operating instructions and contract decisions may have different owners and lead times. The engagement plan should identify those inputs, the time needed to demonstrate operation and the work retained by your organisation.
Illustrative operating decisions
Two European operating models to consider.
Hypothetical examples, not client case studies or claims of completed engagements.
A distributor integrates an acquired subsidiary
A hypothetical European distributor acquires a business in another country. Headquarters provides email and endpoint management, while the acquired company retains its warehouse application and support supplier. The project team first determines how these dependencies affect the intended ISMS scope.
A practical output is an integration control map: named owners, temporary access arrangements, evidence sources and dates for resolving exceptions. The internal review tests the current arrangement instead of assuming the future integration is already complete.
A software group centralises customer support
A hypothetical software group moves support for several European entities onto one platform. Support agents can retrieve diagnostic files that may contain customer information. The programme examines customer permissions, supplier access and retention before treating the platform as a common control.
Security and privacy owners use the same data-flow facts for different decisions. The service team receives clear instructions on collecting, sharing and deleting diagnostic material, with an escalation route for unusual requests.
Our service commitment
100% successful ISO certification guaranteed.
Our guarantee applies to the agreed ISO certification engagement. Confirm its scope and terms in your proposal. The independent certification body conducts the audit and makes the certification decision.
Agree the proposed scope and sites with the independent certification body. The project plan should make central and local evidence responsibilities visible and identify consulting, implementation effort and certification charges separately.
Before you commission the work
Define what a group certificate will mean.
Can one certificate cover several European entities?
That depends on the intended management-system scope and certification arrangement. Establish included entities, sites and shared functions before presenting the certificate as group-wide coverage.
Must every location operate identical controls?
Common controls can be useful, but implementation should reflect the risks and working conditions. Record justified differences and the evidence expected from each owner.
Does certification establish GDPR compliance?
No automatic legal conclusion follows. Security evidence can support privacy work, while applicability, legal bases and transfers require their own assessment.
How should an acquisition be included?
Describe the current arrangement and its dependencies. Identify transitional controls and unresolved risks instead of treating a planned integration as completed implementation.
Can existing supplier reports be reused?
Review their scope, period, findings and relevance. They can inform supplier assurance, but do not establish that your own responsibilities are fulfilled.
What makes a useful initial brief?
Provide the entities, sites, services, shared systems and assurance deadline. Identify the business change driving the project and the people available to own implementation.
Reference basis
Sources and scope of this guidance
ISO: ISO/IEC 27001:2022 overview; EDPB: International data transfers; ISO: independent certification.
Official references checked 13 October 2026. The implementation examples are practical recommendations; legal applicability and the agreed certification scope need their own review.
Plan the engagement
Make the scope match the European business.
Share the services, entities and upcoming change. We can discuss a programme that connects group oversight with the controls and evidence each operating team can maintain.