Determining the Scope of the ISMS

00:01

listen to 0.3.

00:03

Determining the scope off the ice Um s

00:09

a nice mess will be useless without a scope, and you won't be able to be certified unless you have a solid scope to find in this lesson, we're going to take a look at what, exactly? The scope of a nice mess is

00:20

what to consider with regards to defining your scope,

00:23

what to do with items out of your scope and considerations for documenting the scope.

00:34

So what is the scope?

00:37

A nice amiss will be pretty useless if the scope has not been clarified.

00:41

It is important to note what information as that you want to protect

00:45

and then to note where these information assets are produced, obtained, transferred, processed, stored and destroyed.

00:54

All the supporting assets processes and people will need thio

00:59

also be factored in this as this will set the boundaries for your script.

01:07

The scope is part of sub clause 4.3,

01:11

which is part of the overall clause for understanding the organization and its context.

01:18

The scope of the ice, um, establishes what is included in the ice mess what is specifically excluded from the ice mess and sets the physical and logical boundaries.

01:29

The scope is a key piece of documentation for a nice mess, especially ones that are going to be certified against Isis 27,000 and one.

01:40

It is important to remember that if the certification is to be used as a sales or marketing tool,

01:46

that the scope ties in properly with this.

01:49

For example, products or services that are sold from or managed by officers or sections off your organization which are specifically excluded from the certification scope

02:00

and the certificate once awarded,

02:04

cannot be used as a marketing tool for these

02:08

departments that are excluded.

02:12

The BSE, which managers and retains records of all isolators certifications achieved,

02:19

are quite strict on this point and monitor this.

02:22

Using a certificate to falsely advertise can jeopardize the validity off the existing certificate

02:30

along similar lines.

02:32

When you is an organization, rely on the ice oh certification off another organization. It is important to read and understand the scope that has been included as part of that certificate.

02:44

This will give you a clearer view on what has actually been included in the certification, as opposed to making assumptions about which part of the organization have been included in the ice mess.

02:59

So what exactly should be considered for your eyes? My scope?

03:04

Ideally, you want to think about what critical information your organization has.

03:09

This is jumping the gun a bit here at this point,

03:12

but you can tweet your scope afterwards once you have done your risk assessment and so forth.

03:16

Thinking about information that you want to protect

03:20

can make determining the scope easier.

03:23

For example, company proprietary information such as your research and development into a new project.

03:30

Where does this information get created?

03:32

Which teams are involved?

03:35

Where are these teams located?

03:37

What systems are they making use of

03:39

what infrastructure is hosting these systems?

03:43

Does this information go anywhere else in the organization

03:46

at a high level? Answering those questions gives an indication of what needs to be protected within the ice mess

03:53

and therefore, what? The scope of the ice, and they should cover

03:58

off course. You would want to do this for all the key information assets you are looking at protecting.

04:03

You will need to make a decision with the various key. I see Miss Stakeholders generally just the internal ones unless there is a key external stakeholder with the decision making ability for your SMS

04:16

about whether or not the full organization will be covered as part of the initial scope and implementation of the ice mess,

04:23

or whether the scope will first have an initial focus off certain areas and information within the business, with the remaining areas to be included in the ice mess in face approaches at a later stage.

04:34

This is a difficult question either way, but as long as the decision and rational behind it is documented,

04:41

you'll be OK in the audit.

04:43

Auditors do like to question the scope and understand the thinking behind why the scope was said out the way it waas.

04:48

So be prepared to have those discussions

04:51

and be able to answer the questions behind it

04:57

as we mentioned. Information is essential consideration for the scope of your Islamists.

05:02

Consider the departments and business units

05:05

infrastructure in information systems,

05:08

physical site locations

05:10

on third parties which may have to form part of the scope.

05:21

What do we do if items are out of scope?

05:26

So just this is an important Thio

05:28

define and document what will be included in the scope.

05:31

It is also important to document and define specific exclusions from the scope.

05:38

So why does one need to document this?

05:41

Just because something isn't stated in the scope does not mean it is automatically excluded.

05:47

This could appear as an oversight during an audit

05:50

showing documented evidence off the specific exclusions demonstrates that these exclusions have been formally considered.

05:58

Reasons for the exclusion should also be documented. This will help in showing that the consequences off excluding these are not severe or are not applicable or have been accepted.

06:12

This is a critical component to show stakeholders why various components have been excluded.

06:16

You can also include a high level roadmap or indication of Wendy's would be brought into the items if they are critical or if they are simply excluded. Due to being out of direct control of the organization,

06:30

it is considered as part of the risk assessment

06:35

and controls implementation.

06:39

For example, if your organization is a subsidiary on the organization and some mighty functions and infrastructure are wholly owned and managed by your group or parent company, and your organization simply makes use of these assets,

06:51

you may not have direct control over the patching process of servers,

06:55

however, the patching status off service is still something that directly affect the security posture of your organization Relying on these acids.

07:03

Either the infrastructure needs to be included in the scope somehow,

07:08

or a service level agreement between your organization and the department of the parent organization needs to be established if it is not already

07:16

and the service of an agreement included as part of the scope of the ice miss.

07:21

This demonstrates that although the direct control over the physical assets is not possible and therefore out of scope, but the control over the process and ensuring that the patching is in line with the requirements of the organization is demonstrated in the S L A and therefore that would be included.

07:47

So where or how should the scope be documented?

07:55

A formal document as part of the isthmus manual is recommended.

08:00

Your scope should be formally signed off and endorsed by senior management.

08:05

Your scope can be represented as a diagram off components

08:09

or is it written paragraph.

08:13

The scope you define will be included in your orders, reports and your certification.

08:20

Your certification only covers items that you have mentioned and included in the scope

08:31

you can have a standalone scope document

08:33

if you want.

08:35

Otherwise, include your scope and your scope exclusions in your Christmas manual.

08:39

This has benefits in that having ALS. The documentation, which is required for each clause in one manual, makes the maintenance of the documents so much easier

08:48

and also makes for a simple reference point.

08:50

A lot of the closes into link and provide context to each other, so keeping these together is often the best approach

09:03

to recap

09:05

we covered what the scope of a nice mess is and how it relates to your certification.

09:11

We also covered that out of scope items are permissible

09:16

with a few considerations to be aware of.

09:20

We covered what to consider and included in the scope of your SMS,