Scope Statement

A scope statement defines the boundaries of a compliance engagement — specifying which systems, processes, locations, data types, and organizational units are included in the audit or certification. Getting scope right is critical because it determines how much work is required, what evidence must be collected, and what the resulting certification or report covers.

Why Scope Matters

A scope that is too broad increases audit cost, extends timelines, and requires more controls to maintain. A scope that is too narrow may not satisfy customer requirements or regulatory obligations, rendering the certification less valuable.

Scoping for Different Frameworks

ISO 27001 requires a documented scope statement as part of the ISMS (clause 4.3). The scope defines the organizational boundaries, information assets, locations, and processes covered by the management system. The scope appears on the ISO 27001 certificate and must be defensible to auditors.

SOC 2 scope is defined by the system description, which outlines the services, infrastructure, software, people, procedures, and data covered by the audit. The Trust Service Criteria in scope (Security, Availability, Processing Integrity, Confidentiality, Privacy) further define what is evaluated.

PCI DSS scope is determined by the cardholder data environment (CDE) — all systems that store, process, or transmit cardholder data, plus connected and security-impacting systems. Scope reduction through network segmentation is a common strategy.

Defining Your Scope

1. Identify the driver — What is motivating the compliance effort? Customer requirements, regulatory mandates, or strategic goals?
2. Map the system — Document the systems, data flows, personnel, and processes relevant to the engagement
3. Set boundaries — Clearly state what is included and excluded, with justification for exclusions
4. Validate with your auditor — Discuss the proposed scope with your audit firm before the engagement begins

Common Mistakes

Scoping too broadly on a first audit. Start with the critical systems and expand scope over time. A focused scope for your first certification is more practical and still delivers customer-facing value.

Excluding systems that should be included. If a system processes in-scope data or provides security services to in-scope systems, it should be in scope. Auditors will challenge unjustified exclusions.