1.2.1—1.2.1

>Control Description

+ The scope of the ISMS (the organization managed by the ISMS) is defined. + The organization's requirements for the ISMS are determined. + The organizational management has commissioned and approved the ISMS. + The ISMS provides the organizational management with suitable monitoring and control means (e.g. management review). + Applicable controls have been determined (e.g. ISO 27001 Statement of Applicability, completed ISA catalogue). + The effectiveness of the ISMS is regularly reviewed by the management.