Determining the scope of the information security management system

What the requirement asks

To set the ISMS scope the organization decides its boundaries and where it applies. In doing so it takes into account the issues identified under 4.1, the requirements identified under 4.2, and the interfaces and dependencies between its own activities and those carried out by other organizations. The resulting scope has to exist as documented information.

What the guidance adds

Scope is treated as a set of decisions, not a sentence. The guidance walks through the boundaries, the applicability of each part of the organization, the interfaces with bodies outside the ISMS and the reasons for every exclusion. The written scope should let a reader predict what the auditor will and will not sample.

What good looks like

Keep the documented ISMS scope statement naming organizational units, locations, processes, services and technology covered with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• ISMS scopeThe documented ISMS scope statement naming organizational units, locations, processes, services and technology covered
• ISMS scopeA description of interfaces and dependencies on activities performed by other organizations such as outsourced providers and cloud services
• ISMS scopeRationale showing how the 4.1 issues and 4.2 requirements shaped the boundaries
• ISMS scopeConsistency between the scope, the Statement of Applicability and the certificate scope

The question an assessor will ask

An assessor will ask for the documented ISMS scope statement naming organizational units, locations, processes, services and technology covered. The test for 4.3 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• Scope excludes areas that clearly process in-scope information without justification
• Dependencies on outsourced or cloud providers are not described
• The scope document differs from the certificate wording
• Scope was never revisited after reorganizations or acquisitions

Before the next audit

Before the next audit, test this against one live record: scope excludes areas that clearly process in-scope information without justification.