Control 4.3Determining the scope of the information security management system

Determine the boundaries and applicability of the information security management system, taking account of the context from 4.1, the requirements from 4.2, and the interfaces and dependencies between what the organisation does itself and what is done by others. The scope is maintained as documented information.

Scope is the most consequential decision in an ISMS and the one most often made for the wrong reason. Drawn narrowly it certifies quickly and says little; drawn to match how the organisation actually works it is harder and means something. The certificate names the scope, so a reader who does not check it may believe far more has been assessed than was.

The interfaces clause is the trap. Excluding something you depend on does not exclude the dependency — it only removes it from the system that is supposed to manage it, and the risk assessment then has a hole exactly where the outsourced service sits.

How to put this in place

The scope is the first thing the certification body reads and what a customer sees named on the certificate. Without a considered scope, everything built after it has to be redone.

Decide the boundaries from the issues and requirements in 4.1 and 4.2, the services customers buy, the sites, the technology and the people involved.
Name the interfaces and dependencies, such as suppliers and shared services, and the exclusions with their reasons.
Write the scope statement and test it against the services customers buy.
Get top management approval and keep the approved version under document control.
Review it when services, sites or suppliers change.

Evidence an auditor usually looks for: the approved scope statement with interfaces and reasoned exclusions, and consistency with the certification application.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 1 (Decide and scope) of the implementation plan, which sets out the work and the gate that closes the phase.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, item MD-01: the typical form, what auditors accept instead and the gaps they reliably find.
Certification Readiness Self-AssessmentExcel
A blocking item in the readiness assessment, which treats it as needing to be operating before a Stage 2 audit.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.