ISO/IEC 27001 guide
ISO/IEC 27001 scope: boundaries, interfaces and dependencies, and the mistakes that cost you
Clause by clause: Define an ISO 27001 Scope That Matches Your Service →
The scope decides what your ISO/IEC 27001 certificate proves. Here is what clause 4.3 requires, how to draw the boundary around services, systems, sites and people, how to treat cloud and outsourced dependencies, how the wording reads on the certificate, and the mistakes that cost you.
Key points
- The scope is the boundary of your information security management system (ISMS): the services, systems, sites and people it covers and the organisations it depends on. Clause 4.3 requires it; the certificate states it.
- Cover what the certificate must prove. If customers rely on a platform or service, it belongs inside with the teams, sites and cloud environments behind it.
- Nothing in clauses 4 to 10 can be excluded; Annex A controls can be, but only with a justification in the Statement of Applicability.
- Scope sets the effort: audit days and the reach of the risk assessment follow from it.
What clause 4.3 asks you to decide
Your certificate should cover the services customers and regulators rely on and everything protecting the information those services handle. Clause 4.3 of ISO/IEC 27001:2022, "Determining the scope of the information security management system", makes that a recorded decision: you set the boundaries and applicability of the ISMS, taking account of the issues from clause 4.1, the interested-party requirements from clause 4.2 and the interfaces and dependencies between your activities and those other organisations perform, and keep the result as documented information.
Boundaries mark where the ISMS stops. On applicability, clause 1 of the standard is blunt: when conformity is claimed, no requirement in clauses 4 to 10 may be excluded. You may leave out parts of the organisation, with the boundary stated, and Annex A controls judged unnecessary, each justified in the Statement of Applicability under clause 6.1.3, "Information security risk treatment"; the Statement of Applicability guide explains how.
Drawing the boundary: services, systems, sites and people
Work outwards from what you deliver: a short statement for the certificate, backed by a scope document listing inclusions, exclusions with reasons, and interfaces.
Services
Start from the contracts, questionnaires and tenders behind the project and name the services in customers' words: a payroll platform, a contact-centre service, managed cloud operations. Add the functions they depend on: HR screens and offboards privileged users, facilities controls entry, legal holds supplier contracts.
Systems and information
List the information handled and every system that stores, processes or moves it. Beyond production, include the identity provider, code repository and deployment pipeline, support tools, backups, administrators' laptops and the cloud accounts, by region.
Sites
Name each office, delivery centre and data centre involved, and say how home working is covered. ISO/IEC 27006-1, the certification bodies' ISMS standard, was revised in 2024 partly for organisations with few or no relevant physical sites, so remote-first companies can be certified.
People
Identify the teams and roles inside the boundary, including contractors working under your direction. The certification body asks for this headcount early: audit days start from it.
Interfaces and dependencies: cloud, outsourced and shared services
Clause 4.3 asks where your activities meet other organisations', and clause 8.1, "Operational planning and control", makes you responsible for controlling relevant processes, products and services obtained from outside. Outsourcing a process therefore does not take it out of scope; it becomes a dependency managed through contracts, assurance and monitoring.
In the cloud, the provider secures facilities, hardware and core services; you secure configuration, identities, keys, data and logging, and your certification body audits that side. Annex A control 5.23, on the use of cloud services, is where you record how that split is managed.
| Dependency | Position against your scope | What your ISMS must show |
|---|---|---|
| Public cloud hosting | Your accounts and data inside; the provider's infrastructure a dependency | Access and configuration controls, the responsibility split in writing, provider assurance checked against your services and regions |
| Managed service provider or outsourced monitoring | An outsourced process inside the boundary | Contractual security requirements, reporting and escalation, periodic performance review |
| Parent-company shared services | An interface with an entity outside the certified organisation | An internal service agreement, the controls relied on and how you confirm they work |
| Client-controlled devices, networks or virtual desktops | Client controls outside; your people and processes inside | Contract terms on who controls what, client rules briefed to staff, incidents reported both ways |
How the scope reads on the certificate, and why customers read it first
Under ISO/IEC 17021-1, a certificate identifies the organisation and its location (or headquarters and sites, for multi-site certification), the standard and edition, the scope as activities, products and services at each site, the key dates, a unique code and the certification body. ISMS certificates also refer to the Statement of Applicability. You write the scope; the certification body tests it at Stage 1, its readiness review, and Stage 2, then words the certificate from what it audited, so ask to see the wording before issue.
Customers read the scope first because it answers the question behind every supplier review: does this cover what we receive? Reviewers match the legal entity to the contract and look for the service, sites and hosting by name before glancing at dates. Fail that test and the questionnaire returns; authenticity is a separate check, covered in our guide to verifying a certificate.
How scope drives audit days, cost and the risk assessment
The certification body sizes its audit from your scope. ISO/IEC 17021-1 requires it to determine and record audit time for each client, weighing complexity, technology and regulation, outsourcing, sites and risk; ISO/IEC 27006-1 adds an ISMS audit-time method and rules for sampling sites. Headcount inside the boundary is the starting point, and the result carries into every surveillance and recertification audit; the cost guide covers the other drivers.
Scope also sizes the risk work: clause 6.1.2 looks for risks to information within the scope, so the boundary decides what enters the asset inventory, risk register and Statement of Applicability. Fix it before the risk assessment begins. After certification, the certification body reviews any extension, with whatever audit it judges necessary, before granting it; the surveillance and recertification guide lists the changes to report.
The scoping mistakes that cost you
- Leaving out the product customers pay for. A software firm certifies its head office and corporate IT while the platform, its engineers and its cloud accounts sit outside. The audit passes; the first customer to read the certificate rejects it.
- Scoping "the IT department". HR, facilities, operations and development stay out because security is treated as IT's job, yet screening, leavers, physical entry and secure development live in those teams. Auditors find unmanaged interfaces; customers see a certificate for a function they never deal with.
- Silent exclusions. A subsidiary, a second site or a client-dedicated environment is left out without a word, and customers assume coverage until due diligence or an incident says otherwise. Write each exclusion down with its reason and the interface controls.
- Letting the audit budget draw the line. Dropping the site that serves your largest customer saves audit days and defeats the purpose.
Scope statements: weak, better and why
The examples are illustrative; none describes a real organisation.
| Weak statement | Better statement | Why it works |
|---|---|---|
| "Information security management" | "The ISMS for the development, hosting and support of the company's subscription billing platform, delivered from the Singapore office and by remote staff on public cloud in Asia Pacific" | Names the service customers contract for, who delivers it and where it runs |
| "IT infrastructure and operations at head office" | "The ISMS for managed IT and cloud operations services provided to clients from the Dubai office, covering service desk, network operations and engineering" | Certifies the service clients receive, not an internal department |
| "Provision of BPO services" | "The ISMS for customer support and back-office processing delivered from two Manila delivery centres, including supporting HR, IT and facilities" | Names services and sites and brings in the functions controls depend on |
| "All information assets of the group worldwide" | "The ISMS of the UK operating company for its wealth management services at the London office, with group IT services under an internal agreement" | Names the one entity audited and states the group dependency |
How Sterling sets the scope
A boundary your customers recognise and your certification body can audit.
In a Sterling engagement the scope comes first, before the gap analysis measures anything against it: we map services, systems, sites, people and dependencies from the contracts and questionnaires behind the project and agree the statement with your leadership. On either the guided Design™ or managed Drive™ route, the scope and Statement of Applicability stay aligned in Effivity, included with the engagement at no additional cost. We ensure successful certification for our clients. An independent, accredited certification body of your choosing audits and issues the certificate; Sterling does not certify.
Book a free discovery callISO/IEC 27001 scope: questions buyers ask
Can we start with a narrow scope and widen it later?
Yes, if the first scope covers what the certificate is needed for now. Design the asset inventory, risk method and Statement of Applicability so services or sites can be added without rework; the certification body reviews each extension, normally with an audit.
Do remote employees and contractors fall inside the scope?
If they work on in-scope services or information under your direction, yes. They count towards the people in scope, and the Annex A people controls, remote working among them, apply to them.
Does our cloud provider need its own certificate for us to be certified?
The standard does not require one. It requires you to control the cloud services you use, usually by reviewing the provider's certificates or reports and their scope. Your certification body audits your side of the arrangement, not the provider's data centres.
Is the scope the same as the Statement of Applicability?
No. The scope says where the ISMS applies; the Statement of Applicability says which controls are necessary inside it, whether they are implemented and why any Annex A control is excluded. A control marked not applicable for an in-scope activity is a finding waiting to happen.
Can one certificate cover several companies in a group?
Yes, when they operate one ISMS under common management and the certification body accepts the arrangement; each entity and site is then named. Companies running separate systems under different leadership are usually better served by separate scopes.
More ISO/IEC 27001 guides
Every guide in the ISO/IEC 27001 series is written for one question and links back to the hub for the whole picture.
- Annex A: the 93 controls by theme, explained
- ISO/IEC 27001 certification cost: what moves the price
- Effivity for ISO/IEC 27001: the guide
- ISO/IEC 27001 internal audit: planning, conduct and reporting
- ISO/IEC 27001 for professional and legal services
- ISO/IEC 27001 requirements explained, clause by clause
- ISO/IEC 27001 risk assessment and treatment, step by step
- ISO 27001 certification in Singapore and South East Asia
- ISO/IEC 27001 for small businesses and start-ups
- ISO/IEC 27001 for software, SaaS and technology
- The Statement of Applicability: how to write one that survives the audit
- ISO/IEC 27001 vs SOC 2: which one, or both?
Keep exploring
Explore more about ISO/IEC 27001
Watch a video on how to implement ISO 27001 here.
Watch a video on ISO 27001 requirements here.
ISO/IEC 27001 resources
Services for ISO/IEC 27001
Talk to a consultant
Plan your ISO/IEC 27001 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice