How to Define ISO 27001 ISMS Scope (with Examples)

Clause 4 Framing (High Level)

At a high level, Clause 4 work typically covers:

• External and internal issues — markets, regulation, technology debt, culture.
• Interested parties — customers, regulators, staff, cloud providers, investors.
• Scope determination — boundaries of the ISMS documented as information available to interested parties.

You will also maintain related documented information (policies, risk records, SoA, and more) as the rest of the standard requires — without treating any blog list as an exhaustive mandatory-document inventory.

What a Good Scope Statement Usually Includes

• Legal entity / business unit covered
• Products or services covered
• Physical locations and remote-work posture
• Key technology environments (e.g. production AWS account X, corporate IdP)
• Explicit exclusions with justification

Practical Scope Examples

Example 1 — B2B SaaS

“The ISMS covers the design, development, hosting, and support of the Acme Analytics SaaS platform operated by Acme Ltd, including production cloud environments in eu-west-1, the customer support organisation, and related corporate IT systems used to access production. Marketing websites and the US sales CRM tenancy are excluded; access to production from those environments is controlled via the corporate IdP and break-glass procedures.”

Example 2 — Managed Service Provider

“The ISMS covers managed security and infrastructure services delivered from Karachi and Dubai delivery centres for customer environments under MSA, including the MSP’s tooling stack and SOC. Customer-owned on-premises equipment remains the customer’s responsibility except where tools and remote access are under MSP control.”

Example 3 — Bank Subsidiary

“The ISMS covers the digital banking subsidiary’s application development, cloud production, and operations teams in Riyadh. Parent-bank shared services (HR payroll, HQ network) are interfaces: security requirements are flowed via contracts and monitoring; those parent systems are outside certification scope unless they process subsidiary customer data under subsidiary control.”

Common Mistakes

• Scoping “all IT worldwide” without inventory or ownership.
• Excluding development while claiming production security.
• Ignoring suppliers that hold production credentials.
• Writing scope marketing copy instead of operational boundaries.

How CyberSilo Helps

• Facilitated scope workshops for SaaS, MSP, and financial scopes
• Gap analysis against the agreed boundary
• CSA to keep scope-linked controls and evidence organised

Frequently Asked Questions

Can we exclude a data centre or cloud region from ISMS scope?

Only if the exclusion is justified against organisational context and does not undermine information security for activities that remain in scope. Weak or cosmetic exclusions are a common Stage 1 finding.

Is the scope statement the same as the Statement of Applicability?

No. Scope describes the boundaries of the ISMS (organisation, locations, products, processes). The SoA records which Annex A controls apply and why exclusions are justified.

Should startups certify the whole company on day one?

Not always. Many start with the product and production environment that customers care about, then expand. The scope must still be coherent and cover interfaces to out-of-scope parts of the business.

Related ISO 27001 Resources

Gap analysis · Checklist · Policy templates · Pakistan / UAE / Saudi · ISO 27001 hub · CSA