ISO 27001 Certificate Scope
What it is, what it must include, and audit expectations
This guide explains what the Certification Scope is, what it should include and/or exclude, and how your auditor can help you.
What is a Certificate Scope?
The Certificate scope is the sentence that appears on your ISO 27001 Certificate. It describes what your company does in an accurate, but general way.
It’s not the same as the ISMS Scope (although there will be similarities) - it should be shorter, sharper and more concise!
How to write your Certificate Scope
Pointers on writing your Certificate Scope:
- Keep the wording limited (15 - 20 words or less, if possible) - think short and sweet!
- Describe what your company does in an accurate, but general way.
- The Certificate Scope must co-ordinate with what is being audited. For example, you shouldn’t include a reference to a product/ service, office/ location, or department that was excluded from the scope of the audit.
- If your company provides a software, as well as a consultancy service, both must be included in the scope.
- If you are targeting a specific industry, this should be added in as well (e.g. ““Development and operation of XYZ software for [insurance companies]")
- Don’t add in unnecessary wording (fluff), such as referencing the Statement of Applicability or referencing all the systems and tools that you utilise.
- If there are any exclusions, you don’t need to expressly state such exclusions in the Certificate Scope; however, the inclusions do need to be referenced (which will tacitly exclude the exclusions). e.g. if you’re excluding some departments but not others, you might list all the departments that are included (which will implicitly exclude the other departments).
- Remember, the Certificate Scope is not the same as the ISMS scope, but it needs to be connected and the ISMS scope is a helpful starting point!
- Some examples of commonly used Certificate Scopes:
- For software services: “Development and operation of XYZ software"
- For consultancy: “Provision of XYZ consultancy services.”
- For software services and consultancy: “Development and operation of XYZ software and the provision of adjacent consultancy services.”
- If targeting a specific industry: “Development and operation of XYZ software for insurance companies"
How Tempo Audits can help you
Your auditor can help you by:
- Your auditor will review the basic version of the scope that was put in your application form
- They will then discuss your Certificate Scope with you in your Stage 1 audit, and agree a draft version for the Stage 1 report alongside you
- There will be room for further iteration on the Certificate Scope at the Stage 2 audit, up until Tempo issues the certificate
Reviews
Trusted by fast-moving tech teams across the world who value a more human audit experience.
FAQs
ISO 27001 can feel complicated at first. Here are the answers to the questions we hear most from growing teams.
Significant scope changes must be communicated to your certification body. Depending on the impact, a scope extension audit or reassessment may be required to maintain certification validity. Examples of this include: substantial growth in headcount, new products / services, new locations, new entities or companies within scope.
No. Scope expansion requires a new or extended audit. Transfers are limited to maintaining the same scope or reducing it.
Book a call
No forms, no faff – just a conversation and a quote. Prefer to skip straight to it? Fill out the application form and we'll get moving.
Alternatively, if you have all the details,
fill out this form here.
