It is derived from the ISMS scope and names the business activities, the sites and usually the version of the Statement of Applicability the audit was based on. Anything outside it was not audited, however good the organization's security may be there.
A reviewer reading a vendor's certificate should check that the service they buy, and the locations that deliver it, are inside the scope. The ISO 27001 and SOC 2 comparison covers what each document shows a buyer.
Read more
Related terms
- ISMS scope
- The ISMS scope is the documented boundary of an information security management system: the parts of the organization, services, sites and systems it governs.
- Statement of Applicability
- The Statement of Applicability is the mandatory ISO 27001 document listing which Annex A controls apply, which are excluded and why.
- Certification body
- A certification body is the independent organization that audits a management system against an ISO standard and issues the certificate when it conforms.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.