ISMS Scope
Definition
The explicit boundaries of the management system: which organisational units, sites, processes, and information assets are covered. Defined under ISO/IEC 27001 clause 4.3 and must be documented. The scope determines which risks must be assessed and which controls apply.
- Governing clause
- ISO/IEC 27001 clause 4.3
- Defines
- Which units, sites, processes and assets are covered
- Requirement
- Must be documented
- Downstream effect
- Determines which risks are assessed and controls applied
Common questions
Why does a narrowly drawn ISMS scope matter to an incident responder?+
If a compromised system or data flow sits outside the documented ISMS boundary, the organisation's certified controls and incident procedures may not formally apply to it, which can leave a real gap in coverage even though the certificate looks comprehensive on paper.
Can an organisation certify only part of itself under ISO/IEC 27001?+
Yes, clause 4.3 explicitly allows a defined subset of the organisation, such as a single business unit or data centre, to be scoped for certification, provided the boundary and its interfaces with excluded parts are documented and justified.
Related terms
- Annex a
- The normative annex to ISO/IEC 27001 that lists 93 information security controls across four themes: organisational (37 controls), people (8), physical (14),...
- Continual Improvement
- The ISO/IEC 27001 requirement (clause 10) that the organisation must actively improve the suitability, adequacy, and effectiveness of the ISMS over time....
- Management Review
- The annual governance meeting required under ISO 17025 Clause 8.9, at which laboratory management reviews the aggregated quality performance data (PT results,...
- Risk Treatment Plan
- A document that records, for each identified risk, the chosen treatment option (accept, avoid, transfer, or reduce), the specific controls selected to...
- Statement of Applicability (SoA)
- A mandatory document listing every ISO/IEC 27001 Annex A control with a statement of whether it is included or excluded, the justification...