GRC FlowGRC Flow
  • Inside GRC Flow
  • Services
  • Projects
  • Encyclopedia
  • FAQ
  • Contact
FeedbackSign inGet started
  • Inside GRC Flow
  • Services
  • Projects
  • Encyclopedia
  • FAQ
  • Contact
  • Share feedback
  • Sign in
GRC Flow

Governance, risk and compliance workspace: policies, risk assessments, gap assessments and evidence that stay connected.

Product

  • Inside GRC Flow
  • Services
  • Projects
  • Encyclopedia
  • FAQ
  • Contact
  • About

Frameworks

  • ISO/IEC 27001
  • GDPR
  • NIS2
  • DORA
  • HIPAA
  • PCI DSS

Legal

  • Terms
  • Privacy
  • Legal notice

© GRC Flow

  • Inside GRC Flow
  • Services
  • Projects
  • Encyclopedia
  • FAQ
  • Contact

Run Scope Definition

No account needed. Answer a few questions, pay securely, and receive your deliverable right away.

Your company

Your company

The company named in the deliverable.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

Deliverable

Deliverable

Its title, its author and its structure are yours: they steer what is written.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

As it will appear on the deliverable.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

Shown as the author of the deliverable; never filled in by the AI.

Purpose of the scope

Purpose of the scope

What this scope is for, and who answers for it.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

It decides the vocabulary of the document.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

What the certificate or programme has to prove, and to whom.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

Function of the person who keeps it up to date.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

What the scope takes into account

What the scope takes into account

Clause 4.3 asks you to consider your issues and the requirements of interested parties.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

What in your market, your rules and your organisation affects this scope.

Interested partyRequirementWhere it comes from

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

One row per entry, e.g. “Bank partners; ISO/IEC 27001 certificate covering the gateway; Partner contracts”

What is in scope

What is in scope

Name what is covered; anything not named is outside.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

Offices, warehouses, data centres, cloud regions.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

E.g. “Merchant onboarding”.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

E.g. “Payment gateway”, “Microsoft 365”.

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

Categories only, never the data itself.

Interfaces and exclusions

Interfaces and exclusions

Where the scope stops, and what it still depends on.

Party or activityWhat it does for the scopeWho is responsible for whatContract or control at the boundary

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

One row per entry, e.g. “Hosting provider; Hosts the platform; Provider for infrastructure, we for configuration; Contract, SOC 2 report”

What is left outWhyEffect on what stays in scope

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

One row per entry, e.g. “Payroll; Outsourced and unrelated to the platform; HR data stays with the provider”

Keep this field from the AI: its content is replaced before the AI provider receives it, then restored in your deliverable.

Anything the service should take into account.

What the AI provider receives

Your answers, to write this deliverable.

Replaced first, then put back in your deliverable: Email addresses, People's names, Company names.

€1.00

What a free account adds

Running a service never requires an account. An account adds:

  • Your company details filled in for you on every form
  • Every result saved, reusable as a source by any service
  • Results editable in the browser and in the layout editor, with their saved versions
Create a free account