Work Through the Steps
Start With the Business Activity
An information security management system (ISMS) needs a clear business boundary. Choose the activity whose information you need to protect: delivering a hosted service, handling customer support or running the whole business. Name the legal entity and the business owner. Write down why the work matters now and what customers, contracts or other relevant obligations expect. A list of software products cannot explain that business boundary on its own.
Follow the Information
Trace one ordinary piece of work from start to finish. Identify the people, locations, remote-working arrangements, information and systems involved. Include supporting functions that can affect its security, such as staff onboarding, account administration and purchasing. Use existing service and supplier records to check your picture. Mark uncertain boundaries for discussion instead of silently leaving them out.
Name the Dependencies
List the outside organisations and shared services the activity relies on. For each, record what passes across the boundary, who operates it and which decisions remain yours. A cloud provider may run the infrastructure while your organisation manages identities, access and data. Keep that relationship visible even when the provider's own management system is outside your boundary.
Write and Challenge the Scope
Bring the answers into a short statement covering the activity, entity, locations and important supporting processes. Keep detailed system lists as linked working records. For anything left outside, explain the reason and check whether it still connects to in-scope information. Ask a business owner and a technical owner to walk through a real transaction against the draft. Resolve any missing handoff before approving it.
Keep the Decision Current
Record the approver, decision date and unresolved questions. Revisit the scope when a service, location, supplier or responsibility changes. Use the approved boundary to organise the next risk and evidence review. If certification is a goal, discuss the intended certification scope with the certification body early; a completed scope worksheet does not establish that the management system conforms.
Fictional Example: Harbour Scheduling
Harbour Scheduling Ltd provides an online appointment platform. Its operations director and technical lead are preparing a scope draft together.
- Activity
- Development, operation and customer support of the Harbour Scheduling platform.
- People and Places
- The product and support functions, a shared office and approved remote-working locations.
- Supporting Work
- Staff onboarding, access administration, purchasing and incident coordination supporting the platform.
- External Boundary
- The hosting provider runs its infrastructure; Harbour retains ownership of application configuration, access decisions and customer information.
- Question to Resolve
- An affiliated training business uses the same identity service. Its activity is outside the proposal, but the shared-access dependency still needs review.
Watch For
- Choosing a convenient boundary before tracing how the service actually works.
- Leaving shared identity, remote work or supplier relationships unexplained.
- Confusing a scope decision with a decision to omit applicable security work.
Your Next Step
Complete the blank worksheet, resolve its open questions with the named owners, then use the agreed boundary to plan your risk review.