An SMS scope covers the activities that deliver some or all of the organisation's services, possibly bounded by a site, with the organisation as service provider; an ISMS scope covers the activities that manage the confidentiality, integrity and availability of information, possibly bounded by a security perimeter. Either system can cover a whole entity or only part of one. The full requirements of one standard cannot always be met everywhere, for instance where other parties operate all services, although ISO/IEC 20000-1 requires the organisation itself to provide at least some. Where activities lie in both scopes the integrated system should take both standards into account; scope differences can leave services in the SMS outside the ISMS and vice versa. The organisation should align the two scopes as closely as it can so that integration succeeds and its benefits are maximised. ISO/IEC 20000-3 and ISO/IEC 27003 give scope guidance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.