Determining the scope of the information security management system

Plain-language summary

Drawing the boundary of the ISMS — which parts of the organisation, which locations, which systems and information, and which interfaces with other organisations are inside — and writing it down.

What the clause is really asking

Scope is the single most consequential decision in an ISO 27001 project, and the clause gives three inputs: the issues from 4.1, the requirements from 4.2, and the interfaces and dependencies between what you do and what other organisations do. The scope must be available as documented information, and it is what will be printed on the certificate. A scope can legitimately be one business unit or one service, but it cannot exclude the things that unit depends on: if the in-scope service runs on a shared network, uses the group HR system and is hosted by a cloud provider, those interfaces are in scope as dependencies even where the providers themselves are not. Over-scoping ('the whole group') and under-scoping ('the data centre only, not the people') both fail Stage 1 regularly. ISO 9001 users will recognise the clause; the difference is that information flows across organisational lines far more freely than product does, so interfaces matter more.

What auditors look for

Auditors read the scope statement and then walk its edges. Where does in-scope information leave the boundary — to a payroll bureau, a cloud platform, a parent company, a reseller? Is each interface named and treated as a dependency with controls? They test exclusions: an excluded department that shares the same email tenant and file server is a finding waiting to happen. They check the scope matches the SoA, the risk assessment and the asset inventory — the same systems and sites should appear in all four — and that the scope statement actually exists as a document, not as a paragraph someone recites.

Typical evidence

Documented scope statement naming organisational units, locations, information and systems, and the interfaces and dependencies with external parties; a diagram of the boundary (network, data flows, suppliers) is the clearest evidence; consistency between scope, asset inventory, risk assessment and SoA; a record of the reasoning behind any exclusion.

How to comply — recommendations

Write the scope in three parts: what is in (units, sites, services, systems, information types), what is deliberately out and why, and the interfaces — every place information or access crosses to another organisation, with the control that governs it (contract, SLA, access agreement). Draw it as one picture; auditors and new staff understand a diagram faster than a paragraph. Make the scope statement a controlled document with a review trigger (new site, new service, new major supplier). Before certification, read your draft scope aloud against your asset inventory and SoA and fix every mismatch.

Common nonconformities

Scope statement not documented or not available; interfaces and dependencies on other organisations not addressed; exclusions that cut through shared infrastructure or shared people; scope wording on the application to the certification body differs from the ISMS documents; scope not updated after reorganisation, a new site or a move to the cloud.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.