Scope
It is guidance for the people at the top on how to govern the security of information, and it works whether the security work sits inside an ISO/IEC 27001 management system or outside one.
This clause sets the scope, the vocabulary or the structure. It is guidance, not a requirement, and it is the base every later clause builds on.
What clause 1 asks
The document gives guidance on the concepts, objectives and processes of information security governance. It is written for the governing body and top management, for the people who evaluate, direct and monitor an information security management system built on ISO/IEC 27001, and for the people who manage security outside such a system but still within the reach of governance. It applies to organizations of every type and size. Where the text says ISMS, it means an ISMS built on ISO/IEC 27001. The guidance is aimed at the three relationships between an entity and its ISMS set out in Annex B, and other organizations can still use it. This record is written from the published 2020 edition. The edition 3 text is at final draft stage and is not public.
Why it matters
A scope paragraph decides whether the reader is in the room. The standard is not a control catalogue and not a certification scheme. It is the top-level conversation about why information security exists, who answers for it, what direction is set and how performance is reported. Teams that read it as a checklist for the security team miss the point, because most of its duties land on the governing body, not the security function. The scope also draws a line that matters in a group: the ISMS covers the whole organization by definition, and the organization can be the whole entity or only part of it. Getting that line right decides who is accountable for what.
What good looks like
Write a one-page scope note before any clause work. Name the entity, the organization that runs the ISMS, the governing body, the top management and the person who deputises for each. State whether the ISMS covers the whole entity or part of it, and which Annex B relationship applies. Keep the note with the governance papers, not in a folder owned by the security team. Review it when the group structure changes or a new ISMS is created.
Evidence a board or an auditor asks for
An approved scope statement naming the entity, the organization, the governing body and top management; a map of which parts of the entity are inside the ISMS; the list of governing body members with the date they took office.
- Record An approved scope statement naming the entity, the organization, the governing body and top management
- Record a map of which parts of the entity are inside the ISMS
- Record the list of governing body members with the date they took office
Where it commonly fails
- Governing body and top management named only in a policy that nobody has read
- The ISMS scope confused with the certification scope
- The standard described as certifiable in a tender response
What to do before publication
Before the edition 3 text is published, put clause 1 on the scope and foundations agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 3 Terms and definitions
- 5 Use and structure
- 8.2.1 Type A: The entity and the ISMS organization are the same
- 8.2.2 Type B: The entity contains the ISMS organization
- 8.2.3 Type C: One ISMS is shared by multiple entities