How do you Identify and Then Manage Your ISMS Scope?

Latest update:
8 Aug
2022

When you are looking at the processes associated with managing the security of your organisation’s information assets, there are a number of occasions where you will need to consider the scope of what you are doing.  But firstly, we need to answer a basic question.

What is scope?

Scope is simply a description of what is included within the processes you are conducting and what is excluded i.e., what is included within your approach to information security? Within this description, it is important to consider all the different characteristics of your organisation.  For example, it is  likely you need to consider most, if not all, of the following when considering your scope:

  • Processes
  • Technology
  • Departments
  • Physical locations
  • People
  • Services
  • Third parties

You should think of each of the above in terms of their boundaries.  So, your scope description should include an understanding of what is included within the boundary, along with a stated justification for its inclusion and, specifically, what is excluded or held outside the boundary if appropriate.

For example, if you state under physical locations, ‘all physical locations are included’, then there would be no need to state the exclusions as there aren’t any.

It is particularly important to state a justification for something being excluded from scope so that anyone reading the report understands the reason for the exclusion.

So, where does scope need to be considered?  The first is a big picture view.  You need to consider the scope of your information security efforts.

Is it everything that the whole business would benefit from, or does it need to be broken down into smaller component parts?

For example, you might want to ensure that information security is well managed in the departments where personal and customer information are handled and maybe exclude areas where there is no sensitive information.  Or you might want to only concentrate on those business processes that generate significant revenue.

Other areas to consider in terms of scope include your risk management programme and your internal audit programme.  These too have a big picture and a more focused element.

The big picture scope needs to take into consideration all the areas of the business that need to be risk assessed and audited over the duration of your programme, which may cover a three to five-year period.  Whereas, the more focused scope considerations come into play when you are planning individual risk assessments or audits.

Do bear in mind that a sensible, achievable scope should be a starting point.  You may look to extend your big picture scope over time.

So, if ISO 27001 certification is your goal, start with a sensible, meaningful and achievable scope, then look to expand the scope as your approach matures.

If ISO 27001 certification is your goal, start with a sensible, meaningful and achievable scope, then look to expand the scope as your approach matures.
Thumbnail of the Blog Illustration
Information Security
updateD:
23/1/2023
Everything You Need to Know About ISO 27001 Certification

ISO 27001 is the International Standard for Information Security Management. As with all ISO standards, it has been developed by a panel of experts from across the globe and provides a specification

Read more
Thumbnail of the Blog Illustration
Information Security
updateD:
23/6/2022
Benefits of Implementing ISO 27001

What are the Benefits of Implementing ISO 27001? We dig a bit deeper on the benefits that are gained from implementing the standard and from achieving certification.

Read more
Thumbnail of the Blog Illustration
Information Security
updateD:
19/7/2022
How do you Categorise Your Assets When Conducting an Information Security Risk Assessment?

‘How do we approach asset identification within our information security risk assessment?’. This blog examines which assets or asset types to include and should be read...

Read more
"
Great presentation, thanks. I enjoyed the interaction between lead speaker and support person.
Webinar 'Planning Your ISO 27001 Audit Programme'
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.