Key takeaways
- Decide and document what is in and out of the ISMS: locations, teams, systems, services, and interfaces.
- Scope defines what the certificate covers.
- Start here: decide which locations, teams, products and systems are in scope.
Purpose
Decide and document what is in and out of the ISMS: locations, teams, systems, services, and interfaces.
Requirement
Requirement summaryThe organization shall determine the boundaries and applicability of the information security management system to establish its scope. When determining this scope, the organization shall consider: a) the external and internal issues referred to in 4.1; b) the requirements referred to in 4.2; c) interfaces and dependencies between activities performed by the organization, and those that are performed by other organizations. The scope shall be available as documented information.
Why it matters
Scope defines what the certificate covers. A clear boundary avoids confusion and audit surprises.
How to implement
- Decide which locations, teams, products and systems are in scope.
- Consider context, interested party needs and interfaces with out-of-scope areas.
- Write a scope statement and justify any exclusions.
- Make the scope available as documented information.
What evidence you need to provide
Here is what you will typically need to provide for Clause 4.3. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your scope statement: which parts of the business, locations, systems and teams your security programme covers, and anything left out with the reason.
Records and examples to show
- A diagram or description showing connections to things outside scope (such as suppliers or a parent company).
- Proof the scope was approved by management.
Things you should be able to show or explain
- Be able to explain why anything is excluded.
How much to show: The current scope statement.
Common mistakes
- Scope too vague to understand.
- Exclusions with no reason.
- A scope so broad it cannot be managed, or so narrow customers do not value it.
- Ignoring dependencies on out-of-scope teams or suppliers.
- Tip: Keep your scope tight for your first certification — you can always expand it later.
Policies & documents to have
- ISMS scope statement
FAQ
Can we exclude clause 4.3?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
A clear, justified scope that matches reality and the certificate wording.