How do you Identify and Then Manage Your ISMS Scope?

|
|
PUBLISHED on
27 Jul
2022

When you are looking at the processes associated with managing the security of your organisation’s information assets, there are a number of occasions where you will need to consider the scope of what you are doing.  But firstly, we need to answer a basic question.

What is scope?

Scope is simply a description of what is included within the processes you are conducting and what is excluded i.e., what is included within your approach to information security? Within this description, it is important to consider all the different characteristics of your organisation.  For example, it is  likely you need to consider most, if not all, of the following when considering your scope:

  • Processes
  • Technology
  • Departments
  • Physical locations
  • People
  • Services
  • Third parties

You should think of each of the above in terms of their boundaries.  So, your scope description should include an understanding of what is included within the boundary, along with a stated justification for its inclusion and, specifically, what is excluded or held outside the boundary if appropriate.

For example, if you state under physical locations, ‘all physical locations are included’, then there would be no need to state the exclusions as there aren’t any.

It is particularly important to state a justification for something being excluded from scope so that anyone reading the report understands the reason for the exclusion.

So, where does scope need to be considered?  The first is a big picture view.  You need to consider the scope of your information security efforts.

Is it everything that the whole business would benefit from, or does it need to be broken down into smaller component parts?

For example, you might want to ensure that information security is well managed in the departments where personal and customer information are handled and maybe exclude areas where there is no sensitive information.  Or you might want to only concentrate on those business processes that generate significant revenue.

Other areas to consider in terms of scope include your risk management programme and your internal audit programme.  These too have a big picture and a more focused element.

The big picture scope needs to take into consideration all the areas of the business that need to be risk assessed and audited over the duration of your programme, which may cover a three to five-year period.  Whereas, the more focused scope considerations come into play when you are planning individual risk assessments or audits.

Do bear in mind that a sensible, achievable scope should be a starting point.  You may look to extend your big picture scope over time.

So, if ISO 27001 certification is your goal, start with a sensible, meaningful and achievable scope, then look to expand the scope as your approach matures.

Are you looking to implement ISO 27001? Or certify against the Standard?

URM offers a host of consultancy services to assist you implement and maintain ISO 27001, including gap analyses, risk assessments, policy development, auditing and training.
Thumbnail of the Blog Illustration
Information Security
Published on
13/3/2024
How to Meet the ISO 27001 Requirements Around Interested Parties

URM’s blog provides advice and guidance on how you can meet the ISO 27001 requirements around interested parties and their needs and expectations.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
11/1/2024
Developing an ISO 27001-Conformant Integrated Internal Control Framework

URM’s blog provides detailed guidance on aligning an existing control framework with ISO 27001, allowing you to certify and capitalise on previous work.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
20/7/2022
How do You Develop and Implement an Incident Management Plan?

Due to the increased use of technologies and the ‘human’ involvement, it is inevitable we are all going to face more and more information security incidents.

Read more
We engaged URM to help us complete our annual Cyber Essentials Plus certification. They have a great infrastructure and skillset to support the Cyber Essentials program and made the whole process painless for us. It’s a great way for businesses to give themselves a good security health check and in doing so spot any weak points in their IT infrastructure. URM are then perfectly placed to advise on how to fill those gaps for a robust IT / IS policy structure. In summary it’s a great way to show your customers your commitment to cyber security and ultimately keeping their data safe.
Sales engagement platform
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.