Skip to main content
All measures

Measure · ISO 27001 and other standards

Define the ISMS context and scope

Identify the relevant context and requirements, define the scope with its interfaces and make related documents refer to this authoritative description.

Accountable: ISMS owners with managementReviewed

Reuse existing records

Reuse existing context analyses and requirements, process and site records. Maintain the ISMS boundaries once. Individual documents still identify their own audience and the applications or services concerned.

What to do

  1. 1

    Clarify the context and requirements

    Record the internal and external issues that affect your information security. Also decide whether climate change is relevant. Identify relevant interested parties, such as customers or authorities, their requirements and which are addressed through the ISMS. Reuse existing records.

  2. 2

    Define boundaries and interfaces

    Describe the organisations, services, activities and work locations covered in a specific scope statement. Consider connections to other departments and external services. Outsourcing an activity does not remove the need to consider its security-relevant dependencies.

  3. 3

    Approve the scope and connect documents

    Agree the content with the owners concerned and obtain management approval. Make policies and plans refer to this version. When relevant changes occur, check the affected references too. Keep the next planned review in the existing process.

Worked example

A software service uses external hosting

Fictitious example: Muster GmbH develops and operates the Musterportal service. Employees work at the Kiel site and remotely; an external provider supplies the hosting infrastructure.

Shared scope
DecisionThe scope statement names development and operation of the service, the organisation and work locations covered. The employee policy identifies its audience without redefining these boundaries.
EvidenceOne authoritative approved scope description and the documents referring to it.
Hosting interface
DecisionThe organisation describes which tasks belong to the hosting provider, which information is involved and what the service depends on.
EvidenceThe relevant entry in the existing architecture, process or supplier records.

Record the result

  • Approved scope with the relevant context, requirements considered, boundaries and dependencies.
  • Accessible references from related documents. Open changes and their owners are recorded in the existing case.

Common implementation mistakes

Every policy defines new ISMS boundaries

Maintain the boundaries in one place. Each document additionally describes only its own application. A company-wide policy may explicitly apply beyond a narrower ISMS scope.

Exclude external services by default

Consider the relevant interfaces and dependencies even when another organisation carries out the activity.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards

  • ISO/IEC 27001 · 4.1

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The template covers relevant internal and external issues and the climate relevance decision. The organisation must identify and address its actual issues and effects.

    Reference

  • ISO/IEC 27001 · 4.2

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The template provides for relevant interested parties, their relevant requirements and the decision on their treatment through the ISMS. The user must identify the actual obligations and decisions.

    Reference

  • ISO/IEC 27001 · 4.3

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The template connects a specific scope statement with boundaries, applicability, interfaces and dependencies. The organisation must agree and maintain the content on the basis of its context and requirements.

    Reference

Templates for your implementation

Related resources

Sources and further reading