ISO/IEC 27003:2017 ISO27003-4.3: Determining the scope of the information security management system

The organization settles where the ISMS stops and what it applies to, and so fixes its scope. Explanation: the scope says where and for what the ISMS applies and where it does not; it is the foundation for everything else, since risk assessment and treatment, including control selection, cannot give valid results without a precise understanding of it, together with the interfaces and dependencies on other organizations; changing it later can be costly. Factors that shape it: the issues of 4.1; the interested parties and requirements of 4.2; how ready the business activities are to be covered; every support function those activities rely on (for example human resources, IT services and applications, and facility management of buildings, zones, essential services and utilities); and every function outsourced, whether to another part of the organization or to an independent supplier. Scopes vary widely, from one or more processes, functions, services, sections or locations to a whole legal entity, or a whole administrative entity plus one or more of its suppliers. Guidance: work in steps: a small but representative management group sets a preliminary scope; functional units inside and outside it are reviewed and some included or excluded to cut the number of boundary interfaces, taking in all support functions the covered activities need; all managers within the refined scope evaluate it, adjust it if needed and describe it precisely as the final scope; top management formally approves the documented scope. Consider activities that affect the ISMS or are outsourced and identify their physical, technical and organizational interfaces and their effect on the scope. The documented scope should cover the organizational, the information and communication technology, and the physical scope, each with its boundaries and interfaces.