What to take into account
- External and internal issues (clause 4.1).
- Requirements of interested parties (clause 4.2).
- Interfaces and dependencies with activities performed by others, such as cloud providers.
How to write it
- Start from what customers or regulators need covered.
- Name the activities, products and services.
- Name the sites, teams and systems.
- Say what is outside and how the interfaces are protected.
- Keep it short enough to appear on the certificate.
Choosing the width
A narrow scope is faster to certify but may not answer what customers ask. A wide scope gives more assurance and costs more. A scope limited to one product or service is accepted if its boundaries are clear and the controls truly protect it.
Common mistakes
- Excluding a provider or a team the service cannot run without, and ignoring the interface.
- A scope that does not match what the sales team tells customers.
- A scope not updated after a move, an acquisition or a new product.
Questions
- Can an ISMS cover only part of a company?
- Yes, provided the boundaries, interfaces and dependencies are defined and the controls protect what is in scope.
- Is the scope written on the certificate?
- Yes, a scope statement appears on the certificate, so customers can check that it covers the service they buy.