This guide shows how to reach, in six steps, a scope that convinces customers and stays manageable. The standard is paraphrased in our own words, and the examples are invented.
Why this decision moves so much
- Effort: The scope determines what you secure, document and audit.
- Certificate: It appears on the certificate, and customers read it closely.
- Audit days: It affects the effort of the certification body.
- Applicability: Risk assessment and the Statement of Applicability build on it.
A scope that is too narrow saves work at first but rarely convinces a customer. A scope that is too wide overloads the project.
The way in six steps
- Clarify the driver. Why are you building the ISMS: for customers, NIS2 or your own risks? The reason sets the extent.
- Choose the services. Which services and information do your customers want protected?
- Find what is involved. Which processes, sites, teams and systems are needed for that?
- Draw the boundaries. Mark the boundary on the network diagram and name what lies outside.
- Describe the interfaces. Record where data and access cross the boundary, including to service providers and the group.
- Write the scope statement. Agree it with management and get an early quote on that basis.
What belongs in the scope document
| Section | Content | Example |
|---|---|---|
| Scope statement | Short wording for the certificate | See below |
| Sites | Addresses and buildings | Plant A and plant B |
| Organization and processes | Units and procedures | Development, production, service |
| IT and OT | Networks and system groups | Office network, control network hall 1 |
| Interfaces | Connections across the boundary | ERP of the parent company, remote maintenance |
| Exclusions | What stays out, with reasons | Canteen, run by a third party |
| Outsourced services | What others deliver for you | Data center, Microsoft 365 |
Weak and good scope statements
| Weak | Better | Why |
|---|---|---|
| IT operations at site A | Development, manufacture and sale of hydraulic components including the supporting IT and OT infrastructure at sites A and B | Names service, extent and places |
| The entire company | Development and operation of platform X for customers in Europe, with sites in Cologne and Vienna | Sets clear limits |
The scope statement is short. The details are in the scope document.
Does OT belong in it?
In industry this is almost always the deciding question. Our recommendation: if production is your core business and customers expect delivery, include OT, at least networks, remote maintenance access and engineering systems.
- An exclusion removes no risk. It only moves it.
- Interfaces remain. Even with an exclusion you describe and secure the MES link and data exchange.
- Stages are possible. You can start with one plant and extend in later cycles.
Exclusions and outsourced services
Exclusions are allowed. They must be traceable and must not concern anything the security of the scope depends on.
Outsourced services are often in scope even if a third party delivers them. Your task is then to steer the service provider, not to run the service. Describe what you do yourself and what the provider is responsible for.
This is different from the controls in Annex A: there you justify in the Statement of Applicability what applies.
Scope and NIS2
You set the scope of an ISMS yourself. The BSIG (German BSI Act), by contrast, covers all IT systems, components and processes the entity uses to provide its services (§ 30(1) BSIG). Certifying only one site does not cover NIS2 for the whole company. Check both boundaries together. Our guide on ISO 27001 and NIS2 has the details.
Example from industry
The example is invented. A maker of hydraulic components wants ISO 27001 certification because a major customer asks for it.
- First draft: "IT operations at site A." But the customer exchanges design data, and that also sits in development.
- Revision: Development, manufacture and sale at both sites, including IT and OT.
- Exclusion: The rented warehouse stays out, with the reason in the document.
- Interface: The remote maintenance of a machine supplier is described separately.
Checklist
- The driver and customer expectations are clear.
- Sites, units and processes are set.
- The decision on OT is made and justified.
- Interfaces and dependencies are described.
- Exclusions are justified.
- Outsourced services are named.
- The scope statement is agreed with management.
- The scope exists as documented information.
The scope in Complass
A Word file and a network diagram in another folder drift apart fast. In Complass the scope is where the project begins:
- Guided project: The ISO 27001 module leads you from context through scope to the certification audit.
- Template with guidance: The document "ISMS scope" has sections for scope statement, sites, interfaces and exclusions.
- Graphic: You attach network diagrams and site plans as images or PDFs. Images appear in the Word and PDF export, PDF files as an annex with a checksum.
- Release: The document is versioned and released.
- Next steps: The Statement of Applicability and risks build on it in the same project.
Frequently asked questions
May we start with part of the company?
Yes. The standard does not require the whole company. But the scope has to fit your issues and interested parties, and the interfaces have to be described.
Can we change the scope later?
Yes. Agree this with the certification body, because the certificate and audit effort can change.
Do cloud services belong in the scope?
If they process information in scope, you have to take them into account. You then steer the provider, even though it runs the service.
How long should the scope statement be?
The standard sets no length. One or two sentences naming service, extent and places are usually enough.
Does the scope have to be a separate document?
It has to be available as documented information. The form is free. A separate document makes the audit easier.
In a demo we show you how to get from context to a released scope in Complass.
Request a demo Try it for 14 days
Read more
- Guide "ISO 27001 Statement of Applicability"
- Guide "ISO 27001 mandatory documents at a glance"
- Guide "Zones and conduits in IEC 62443 explained"
- Whitepaper on the road to ISO 27001 certification
- ISO/IEC 27001 in Complass: from project brief to certification audit
Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The wording of your licensed edition of the standard is authoritative. As of November 2026.