Guide 02 · Step 1 of 5

Scope the ISMS

Decide what the certificate will actually cover, before you write a single policy.

Independent guidance from Synergy. ISO/IEC 27001 and ISO 22301 are published by ISO/IEC, which has no affiliation with Synergy and has not reviewed this material. This material is provided for informational purposes only and does not constitute compliance or legal advice. Always work from the published text of the standard.

The first real decision in an ISO/IEC 27001 project is not which controls to apply. It is what the certificate is going to say. That sentence — the scope statement — determines how much work follows, who has to be involved, and whether the audit is survivable.

Most first-time projects get this wrong in the same direction: they scope too wide. "The whole company" sounds rigorous and is usually a way of avoiding the decision.

What the standard actually requires

ISO/IEC 27001:2022 clause 4.3 requires the organisation to determine the boundaries and applicability of the information security management system. That means three things in writing: what business processes are covered, what locations and technology are covered, and — critically — what interfaces and dependencies exist with parties outside the scope.

A scope that survives contact

A workable first scope for an organisation under 200 people is usually one product line, or one legal entity, or one customer-facing service — plus the shared infrastructure it actually depends on. Write it as a paragraph and a diagram, not a list of departments.

• In scope — the services, the systems that deliver them, and the people who operate them.
• Out of scope, with justification — and be honest about why. "Not yet ready" is a defensible reason. "Not relevant" usually is not.
• Dependencies that cross the boundary — hosting provider, SaaS, contractors, the managed service provider who holds your backups. These are not excluded just because they are external.