ISMS PUBLIC SCOPE STATEMENT
ABC Technologies is dedicated to safeguarding its own and its customers' information/data.
The Information Security Management System (ISMS) governs the delivery of reliable and managed
information security services which include the protection of ABC Technologies’ software products, Software
development process, IT services & network, and Databases. The ISMS is applicable also applicable Legal Team,
HR Department, and Finance department. This complies with the Statement of Applicability.
ISMS SCOPE BOUNDARIES
ORGANIZATIONAL BOUNDARIES
Order processing activity
IT team
Software Activity Team
Software Development
HR Department
Finance Department
Legal Team
PHYSICAL BOUNDARIES
Head Office (Bradford)
Sales Office (Leeds)
INFORMATION SECURITY BOUNDARIES
Networks: VPN, Internal Network at Leeds & Bradford
Operating Systems: Window 10
Applications: CRM (ABC Supreme, ABC Pro, and AB), Payroll Application, Softprod Database, Customer
Database
Data: Financial and accounting data, marketing plans, product source code, Software Data Stored in ABCloud,
Human resources data,
Processes: Remote connection Via VPN, Orders sent Via mail, IT network management process
Telecommunications equipment: Central file Servers, Central Server, Work stations, Laptops, Routers,
switches.
EXCLUSIONS FROM SCOPE
3D Graphics Team
Printing Team
ABCloud
Website Development
Physical Access Control
Internal Audit Department
Security and Environment Department
JUSTIFICATION OF INCLUSIONS AND EXCLUSIONS
As Kang & Kim (2017) observed, when defining the scope, it should be in terms of the business’s primary
service and core process which aids in the selection of assets and business process included or excluded from
the scope. Also, Chopra & Chaudhary (2019, p.25) discussed how identifying the scope can be complicated by
several factors and one must take into account the organization's entities, locations, departments, and any
products or services provided. They further discussed the need to examine the business process flow and
critical relationships between the organization's activities and those that are outsourced to another company
to enable determine what is to be included and excluded from the scope. As such, analyzing the software
activity process of ABC Technologies, its supporting activities and, the requirements provided by ABC
Technologies’ management, the business process and assets to include and exclude was decided.
JUSTIFICATION OF SCOPE SIZE
Kosutic (2010) Comparing the pros and cons of having a wide and limited scope and shows that if
the ISMS scope has to be limited, it is necessary to understand the boundaries and relationships between the
organizational units in the ISMS scope and the unit outside of the scope. After concluding this, an operational
level agreement (OLA) has to be signed with every unit out of scope as they are treated as 3rd parties.
Considering this, I have decided to set a limited scope as only ABC Technologies’ software activity is to
be included in the ISMS. However, after reviewing the processes and data to be protected, the scope has
been extended to include departments as listed in the boundaries.
REFERENCE LIST
Chopra, A. and Chaudhary, M. (2019) Implementing an Information Security Management System: Security
Management Based on ISO 27001 Guidelines. Berkeley, CA: Apress L. P.
Dilz, J. (2020) Key scoping factors when pursuing ISO 27001
certification. @CoalfireSys. [Link]
when-pursuing-iso-27001-cert
Kang, H. and Kim, J. (2017) A Study on Selection of Core Services for Deciding ISMS Scope. Journal of The Korea
Society of Computer and Information 22 (2), 51-57.
Kosutic, D. (2010) Problems with defining a small ISMS scope in ISO
27001. [Link]
27001/
Leal, R. (2021) ISO 27001 scope: How to define it if servers are in the
cloud. [Link]
the-cloud/