ISO 27001 clause 4.3 requires the scope to be set from the organization's context, the needs of interested parties and the interfaces with what sits outside it, and to be kept as documented information. A narrow scope is easier to certify but may leave out what customers care about; a scope that omits a shared platform or a key team is a common Stage 1 finding.
The implementation guide covers how to set it. See certificate scope for what ends up on the certificate.
Read more
Related terms
- Certificate scope
- The certificate scope is the statement on an ISO 27001 certificate describing which services, locations and organizational units the certification covers.
- Information security management system
- An information security management system is the set of policies, processes and responsibilities an organization uses to manage information security risk.
- Interested parties
- Interested parties are the people and organizations whose requirements an ISMS must take into account: customers, regulators, staff, owners and suppliers.
- ISO 27001
- ISO/IEC 27001 is the international standard for an information security management system, certified by an accredited body on a three-year cycle.