Writes the scope statement as ISO/IEC 27001 clause 4.3 asks: it takes account of your issues and of what interested parties require, states the sites, activities, systems and information covered, the interfaces and dependencies with others, and each exclusion with its reason. Only what you state appears; what is missing is listed for you to settle.
Contents
1. Document Information
2. Scope Statement
3. Purpose and Context
4. Requirements of Interested Parties
5. What Is in Scope
6. Interfaces and Dependencies
7. Boundary Review
8. Exclusions
9. Exclusion Review
10. Points to Settle
11. Approval and Review
12. Document Version History
What you provide
Deliverable — Its title, its author and its structure are yours: they steer what is written.
Purpose of the scope — What this scope is for, and who answers for it.
What the scope takes into account — Clause 4.3 asks you to consider your issues and the requirements of interested parties.
What is in scope — Name what is covered; anything not named is outside.
Interfaces and exclusions — Where the scope stops, and what it still depends on.
