How do you Identify and Then Manage Your ISMS Scope?

What is scope?

Scope is simply a description of what is included within the processes you are conducting and what is excluded i.e., what is included within your approach to information security? Within this description, it is important to consider all the different characteristics of your organisation.  For example, it is  likely you need to consider most, if not all, of the following when considering your scope:

• Processes
• Technology
• Departments
• Physical locations
• People
• Services
• Third parties

You should think of each of the above in terms of their boundaries.  So, your scope description should include an understanding of what is included within the boundary, along with a stated justification for its inclusion and, specifically, what is excluded or held outside the boundary if appropriate.

For example, if you state under physical locations, ‘all physical locations are included’, then there would be no need to state the exclusions as there aren’t any.

‍

It is particularly important to state a justification for something being excluded from scope so that anyone reading the report understands the reason for the exclusion.

So, where does scope need to be considered?  The first is a big picture view.  You need to consider the scope of your information security efforts.

Is it everything that the whole business would benefit from, or does it need to be broken down into smaller component parts?

For example, you might want to ensure that information security is well managed in the departments where personal and customer information are handled and maybe exclude areas where there is no sensitive information.  Or you might want to only concentrate on those business processes that generate significant revenue.

Other areas to consider in terms of scope include your risk management programme and your internal audit programme.  These too have a big picture and a more focused element.

The big picture scope needs to take into consideration all the areas of the business that need to be risk assessed and audited over the duration of your programme, which may cover a three to five-year period.  Whereas, the more focused scope considerations come into play when you are planning individual risk assessments or audits.

Do bear in mind that a sensible, achievable scope should be a starting point.  You may look to extend your big picture scope over time.

So, if ISO 27001 certification is your goal, start with a sensible, meaningful and achievable scope, then look to expand the scope as your approach matures.

‍