How do you Identify and Then Manage Your ISMS Scope?

27 Jul

Table of Contents

When you are looking at the processes associated with managing the security of your organisation’s information assets, there are a number of occasions where you will need to consider the scope of what you are doing.  But firstly, we need to answer a basic question.

What is scope?

Scope is simply a description of what is included within the processes you are conducting and what is excluded i.e., what is included within your approach to information security? Within this description, it is important to consider all the different characteristics of your organisation.  For example, it is  likely you need to consider most, if not all, of the following when considering your scope:

  • Processes
  • Technology
  • Departments
  • Physical locations
  • People
  • Services
  • Third parties

You should think of each of the above in terms of their boundaries.  So, your scope description should include an understanding of what is included within the boundary, along with a stated justification for its inclusion and, specifically, what is excluded or held outside the boundary if appropriate.

For example, if you state under physical locations, ‘all physical locations are included’, then there would be no need to state the exclusions as there aren’t any.

It is particularly important to state a justification for something being excluded from scope so that anyone reading the report understands the reason for the exclusion.

So, where does scope need to be considered?  The first is a big picture view.  You need to consider the scope of your information security efforts.

Is it everything that the whole business would benefit from, or does it need to be broken down into smaller component parts?

For example, you might want to ensure that information security is well managed in the departments where personal and customer information are handled and maybe exclude areas where there is no sensitive information.  Or you might want to only concentrate on those business processes that generate significant revenue.

Other areas to consider in terms of scope include your risk management programme and your internal audit programme.  These too have a big picture and a more focused element.

The big picture scope needs to take into consideration all the areas of the business that need to be risk assessed and audited over the duration of your programme, which may cover a three to five-year period.  Whereas, the more focused scope considerations come into play when you are planning individual risk assessments or audits.

Do bear in mind that a sensible, achievable scope should be a starting point.  You may look to extend your big picture scope over time.

So, if ISO 27001 certification is your goal, start with a sensible, meaningful and achievable scope, then look to expand the scope as your approach matures.

Are you looking to implement ISO 27001? Or certify against the Standard?

URM offers a host of consultancy services to assist you implement and maintain ISO 27001, including gap analyses, risk assessments, policy development, auditing and training.
Thumbnail of the Blog Illustration
Information Security
Published on
Three Tips to Help you Simplify your Risk Management Process

A key role of risk management is helping organisations decide how limited resources can be most effectively used to address the most pressing business issues.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
What Are the Critical Steps When Implementing an Effective Information Security Management System?

URM assisted over 350 organisations achieve ISO 27001 certification, here are the critical steps when implementing an effective information security system.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
ISO 27001 vs SOC 2 - Part 2

2nd part of question and answer session where URM compared and contrasted 2 of the world’s leading information security standards, ISO 27001 and SOC 2.

Read more
Great presentation, thanks. I enjoyed the interaction between lead speaker and support person.
Webinar 'Planning Your ISO 27001 Audit Programme'
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.