Clause 4.3 Determining the scope of the information security management system
Clause 4.3 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Determining the scope of the information security management system. To set the ISMS scope the organization decides its boundaries and where it applies. In doing so it takes into account the issues identified under 4.1, the requirements identified under 4.2, and the interfaces and dependencies between its own activities and those carried out by other organizations. The resulting scope has to exist as documented information.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 4.3 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 4), in our words, not a statement of the standard and not binding on an assessor.
- The documented ISMS scope statement naming organizational units, locations, processes, services and technology covered
- A description of interfaces and dependencies on activities performed by other organizations such as outsourced providers and cloud services
- Rationale showing how the 4.1 issues and 4.2 requirements shaped the boundaries
- Consistency between the scope, the Statement of Applicability and the certificate scope