The ISO/IEC 27001 certificate does derece necessarily mean the remainder of the organization, outside the scoped area, has an adequate approach to information security management. It is a?framework of policies and procedures for systematically managing?an organization’s sensitive data.