Six ISO 27001 scope statement examples for small companies, what clause 4.3 requires, and how an auditor tests the boundary.
An ISO 27001 scope statement is short documented information, usually one to three sentences, required by clause 4.3 of ISO/IEC 27001:2022, that says which parts of your organisation the information security management system (ISMS) covers: the products or services, locations, people, systems and data, plus anything deliberately left out and why. For a company of 5 to 200 people, the strongest ISO 27001 scope usually covers the whole company and the product customers actually buy, because that is what a customer assumes the certificate means.
ISO 27001 clause 4.3 requires an organisation to determine the boundaries and applicability of its ISMS and keep the scope as documented information. The ISO 27001 scope must consider three inputs: the issues identified under clause 4.1, the interested-party requirements identified under clause 4.2, and the interfaces and dependencies with activities performed by other organisations. The table turns those requirements into the elements an ISO 27001 scope statement should contain.
| Scope element | Example wording |
|---|---|
| Products or services covered | "the development, operation and support of the Company X analytics platform" |
| Locations | "delivered from the Austin, Texas office and by remote staff in the United States" |
| People and teams | "all 38 employees and contractors" |
| Systems and data | "production cloud environment, source code repositories and corporate SaaS applications" |
| Interfaces and dependencies (clause 4.3 c) | "hosting is provided by a third-party cloud provider, managed as a supplier" |
| Exclusions with a reason | "excludes the retail hardware division, which shares no systems or staff" |
| Statement of Applicability reference | "in accordance with Statement of Applicability version 1.2" |
Clauses 4 to 10 of ISO 27001 can never be excluded. Annex A controls are not excluded in the scope statement either: any Annex A control an organisation does not apply is justified in the Statement of Applicability under clause 6.1.3 d).
The six ISO 27001 scope examples below are illustrative, written for fictional companies, with "Company X" standing in for your legal entity name. The table summarises the boundary each example draws.
| Example | People in scope | Locations | Main thing left out |
|---|---|---|---|
| 1. Remote SaaS startup | 18 of 18 | None physical, fully remote | Nothing; cloud hosting treated as a supplier |
| 2. SaaS company with an office | 60 of 60 | 1 office | Nothing; office included |
| 3. One product line of a larger company | 45 of 140 | 1 of 3 sites | 2 other product lines and their sites |
| 4. Managed IT service provider | 32 of 32 | 1 office, client sites for support | Client-owned infrastructure |
| 5. Consultancy or professional services firm | 25 of 25 | 2 offices | Nothing; client data handling is the focus |
| 6. Health technology company | 70 of 70 | 1 office, remote staff | A legacy product being retired |
Example 1, a remote SaaS startup. "The ISMS of Company X covers the development, operation and support of the Company X customer platform and the customer data it processes, delivered by all staff working remotely, including the production cloud environment, source code repositories, SaaS applications and company laptops. Cloud hosting is provided by a third-party cloud provider managed as a supplier. In accordance with Statement of Applicability version 1.0."
Example 2, a SaaS company with an office. "The ISMS of Company X applies to the development, hosting and support of the Company X workflow platform, delivered from its Denver, Colorado office and remotely, including all staff, processes and IT systems, in accordance with Statement of Applicability version 2.1."
Example 3, one product line of a larger company. "The ISMS covers the people, processes and technology supporting the Company X Payments product, operated from the Chicago, Illinois office. The Retail and Logistics business units are excluded, as they share no systems, networks or staff with Payments. Corporate HR and IT are treated as internal interfaces."
Example 4, a managed IT service provider. "The ISMS of Company X covers managed IT, help desk and cloud administration services delivered from the Atlanta, Georgia office, remotely and at client premises, including the tools, credentials and client information staff use. Infrastructure owned and operated by clients is outside the scope."
Example 5, a consultancy or professional services firm. "The ISMS applies to the delivery of management consulting and data analysis services by Company X from its Boston and New York offices, including the handling of client information and all staff and systems supporting those services."
Example 6, a health technology company. "The ISMS covers the development, operation and support of the Company X patient scheduling platform and the protected health information it processes, delivered by all staff from the Nashville, Tennessee office and remotely. The legacy Company X desktop product, being retired in 2027 and holding no customer data, is excluded."
Define the ISO 27001 scope before the risk assessment, because the risk assessment, the Statement of Applicability and the audit plan all depend on the boundary. A practical sequence:
The ISO 27001 gap analysis is a good place to test a draft scope.
A company of 5 to 200 people should usually put the whole organisation in its ISO 27001 scope. In a small company the same people, laptops and identity provider support every product, so carving out a part rarely removes much work and adds interfaces to document. A narrow scope makes sense when a business unit is genuinely separate, as in example 3.
| Factor | Whole-organisation scope | Narrow scope (one product or site) |
|---|---|---|
| Audit time | Based on all people doing work in the ISMS | Based on fewer people, so potentially fewer audit days |
| Interfaces to document | Mostly external suppliers | External suppliers plus internal teams outside the scope |
| Buyer perception | Matches what most customers expect | Customers may check whether their product is covered |
| Extending later | Nothing to extend | A scope extension needs a further audit |
Audit time drives the certification body fee. Under ISO/IEC 27006-1, a certification body calculates audit days mainly from the number of people doing work within the ISO 27001 scope, adjusted for complexity and risk, so ask two or three bodies to quote the same scope statement. The ISO 27001 certification cost guide breaks down the rest of the budget.
An ISO 27001 scope should exclude only what is genuinely separate: a business unit with its own staff and systems, a product being retired, or infrastructure a client owns and runs. An auditor tests each exclusion at the stage 1 audit. If the excluded team shares laptops, the identity provider, code repositories or the office network, expect the boundary to be challenged.
Outsourcing is not an exclusion. A cloud provider hosting your production systems is a dependency managed through Annex A controls 5.19 to 5.23 on supplier relationships, including control 5.23 on information security for the use of cloud services. Common exclusions that do not survive a stage 1 audit:
The stage 1 vs stage 2 audit guide explains what the auditor reviews at each stage.
After certification, the ISO 27001 scope is printed on the certificate, usually in shortened form, and accredited certificates can appear in public registers such as the IAF CertSearch database. Customers read that wording, so vague scope wording such as "information security" on its own is a problem: a buyer cannot tell whether their product is covered.
An ISO 27001 scope template is not enough when the organisation has several legal entities, operates under several national regulators, or shares infrastructure with business units it wants to exclude. There an experienced consultant is worth the cost. No template replaces the independent certification body, which decides whether the boundary is acceptable.
For a single company, the scope statement is a one-page task; the harder work is what it feeds: the risk assessment, the Statement of Applicability and the evidence for each control. CertAssist lays out every ISO 27001 Annex A control and the management clauses on one board, with editable policy and evidence templates and the Statement of Applicability handled, for US$225 per month as of October 2026 (a limited-time launch price, normally US$375 per month). CertAssist does not connect to your systems, so it will not discover assets for you.
What is the scope of ISO 27001?
The scope of ISO 27001 is the defined part of an organisation that its information security management system covers: the products or services, locations, people, systems and information inside the boundary. Clause 4.3 of ISO/IEC 27001:2022 requires every organisation to determine that scope and keep it as documented information. An ISO 27001 scope can be the whole organisation or a clearly separated part.
How do you define ISO 27001 scope?
You define ISO 27001 scope by listing the issues and interested-party requirements from clauses 4.1 and 4.2, mapping where your important information is stored and processed, and drawing a boundary around every person, location and system that touches it. Then record supplier interfaces, write the statement and have top management approve it before the risk assessment starts.
How do you write an ISO 27001 scope statement?
An ISO 27001 scope statement is written as one to three plain sentences naming the products or services covered, the locations they are delivered from, the people and systems involved, any exclusions with a reason, and the Statement of Applicability version it relies on. Avoid vague phrases, because the statement appears on the certificate.
What is the ISO 27001 scope of applicability?
The ISO 27001 scope of applicability usually refers to two linked documents. The scope statement under clause 4.3 sets which parts of the organisation the ISMS covers. The Statement of Applicability under clause 6.1.3 d) lists all 93 Annex A controls, says which apply within that scope, and justifies any that are excluded.
Is ISO 27001 certification worth it?
ISO 27001 certification is usually worth it when customers, tenders or partners ask for it, because a certificate from an accredited certification body answers many security questionnaire questions at once. ISO 27001 certification is less worth it when no buyer has asked. Certification needs an annual surveillance audit and recertification every three years.
CertAssist lays out every ISO 27001 Annex A control and management clause, gives you editable policy and evidence templates, and lets your auditor review it all in one place, for US$225 a month.
See pricing FrameworksFlat $225 a month, or $2,475 a year (12 months for the price of 11). All prices in USD.
