# ISMS Scope Definition
URL: https://docs.autociso.io/console/iso/scope/
Description: The scope defines the boundary of your Information Security Management System — what systems, processes, people, and locations are covered by your ISO 27001 certificate.

*This is the help text the console shows in the help panel on this page.*

The scope defines the boundary of your Information Security Management System — what systems, processes, people, and locations are covered by your [ISO 27001 certificate](https://docs.autociso.io/console/iso/certificate/). A well-defined scope is the foundation of a credible certification.

### Workflow
1. Under **Required before AI draft**, pick the regions where customer data is stored (EU, US, APAC, IL, Other) and answer whether any customer data resides in the EU.
2. Click **Generate Scope with AI** to produce a draft scope statement and in-scope/out-of-scope item list.
3. Review and adjust the two-column item list — use **+ Add item**, the arrow button to move items between In Scope and Out of Scope, or the X to remove one.
4. Edit the **ISMS Scope Statement** directly; it saves automatically when you click away.
5. When the statement is written and at least one item is In Scope, click **Sign & Lock Scope** and confirm with **Confirm Sign**. A signed scope cannot be edited.

### Versioning
After signing, the page shows the signed date and version, and the button changes to **Create new version**. If your ISMS scope changes (e.g., after a merger), create a new version rather than editing the signed one — this preserves the audit trail.

### Auditor Expectations
Your [Stage 1 auditor](https://docs.autociso.io/console/iso/auditor-portal/) will review the scope statement first. It should clearly state the organization name, locations, systems, and the nature of the information being protected.

## Fields

### Data Residency Regions

Select all regions where customer data is stored (EU, US, APAC, IL or Other). Required before you can generate the scope with AI; it shapes the draft scope statement.

### EU Customer Data

Whether any customer data resides in the EU. Required before you can generate the scope with AI; a 'Yes' makes the draft mention EU personal-data handling.

### Scope Statement

The formal narrative describing what is included in your ISMS. Should reference: organization name, physical locations, systems and services, and the type of information protected.

**Example:** *"The ISMS of [Company] covers the development, delivery, and support of its cloud-based SaaS platform, including all related infrastructure hosted in AWS eu-west-1, and all employees and contractors with access to production systems."*