ISMS Scope Definition

This is the help text the console shows in the help panel on this page.

The scope defines the boundary of your Information Security Management System — what systems, processes, people, and locations are covered by your ISO 27001 certificate. A well-defined scope is the foundation of a credible certification.

Workflow

1. Under Required before AI draft, pick the regions where customer data is stored (EU, US, APAC, IL, Other) and answer whether any customer data resides in the EU.
2. Click Generate Scope with AI to produce a draft scope statement and in-scope/out-of-scope item list.
3. Review and adjust the two-column item list — use + Add item, the arrow button to move items between In Scope and Out of Scope, or the X to remove one.
4. Edit the ISMS Scope Statement directly; it saves automatically when you click away.
5. When the statement is written and at least one item is In Scope, click Sign & Lock Scope and confirm with Confirm Sign. A signed scope cannot be edited.

Versioning

After signing, the page shows the signed date and version, and the button changes to Create new version. If your ISMS scope changes (e.g., after a merger), create a new version rather than editing the signed one — this preserves the audit trail.

Auditor Expectations

Your Stage 1 auditor will review the scope statement first. It should clearly state the organization name, locations, systems, and the nature of the information being protected.

Fields

Data Residency Regions

Select all regions where customer data is stored (EU, US, APAC, IL or Other). Required before you can generate the scope with AI; it shapes the draft scope statement.

EU Customer Data

Whether any customer data resides in the EU. Required before you can generate the scope with AI; a ‘Yes’ makes the draft mention EU personal-data handling.

Scope Statement

The formal narrative describing what is included in your ISMS. Should reference: organization name, physical locations, systems and services, and the type of information protected.

Example: “The ISMS of [Company] covers the development, delivery, and support of its cloud-based SaaS platform, including all related infrastructure hosted in AWS eu-west-1, and all employees and contractors with access to production systems.”