Type C: One ISMS is shared by multiple entities
One management system can serve several entities, and its security objectives have to align with the mutual objectives that bind those entities together.
What clause 8.2.3 asks
Sometimes one management system serves several entities. Its leadership still governs and controls it in the usual way, but its reach crosses legal boundaries. A group may share a common security context for a slice of activity, such as collecting, processing, storing and using personal data. Several boards may also share one system run as a service for many customers. The four processes stay the same. The system's security objectives should line up with the shared business aims that hold the member entities together. Where members have a direct interest, their boards may place people on the system's leadership; where a third party provides the service, that is unlikely. A shared system that serves only its provider has lost the thread.
Why it matters
Type C is the hardest governance shape because the system has customers rather than one owner. A shared service can be well run and still fail the governance test if its objectives serve the provider and none of the member entities. The clause asks for the mutual objectives first, then the alignment. That order matters: if the member entities have not written down what they share, the system has nothing to align to except its own service targets. The membership question is also sharper here. A member entity with a direct interest should be able to put someone on the top management. A customer of a third party service usually cannot, so its protection has to come through the contract, the service definition and the assurance rights it negotiated.
What good looks like
Write the mutual objectives of the member entities and the security objectives that serve them. Record the governance arrangement: who sits on the top management, which governing bodies are represented, and how a member raises a concern. For a third party service, write the assurance rights, the reporting the provider must give and the exit plan. Test the arrangement with a scenario in which one member needs a different level of protection from the others, and record how the conflict would be resolved.
Evidence a board or an auditor asks for
The mutual objectives and the aligned security objectives; the governance arrangement and membership; the member concern route; for a third party service, the assurance rights and exit plan; the conflict scenario and its resolution.
- Record The mutual objectives and the aligned security objectives
- Record the governance arrangement and membership
- Record the member concern route
- Record for a third party service, the assurance rights and exit plan
- Record the conflict scenario and its resolution
Where it commonly fails
- A shared system whose objectives serve the provider and none of the member entities
- Member entities with no seat in the shared system governance
- A service contract with no assurance rights
What to do before publication
Before the edition 3 text is published, put clause 8.2.3 on the the governing body and the isms agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 3 Terms and definitions
- 7.3.1 General
- 8.1 Organization and ISMS
- 8.2.2 Type B: The entity contains the ISMS organization
- B Types of management system organization
← 8.2.2 Type B: The entity contains the ISMS organizationA Governance relationship →