ISO/IEC DIS 27007, Edition 4 (unpublished), Annex A, A.1.3, read with ISO/IEC 27001:2022, Clause 4.3
Scope of the ISMS
No substantive change.
Three layers on this page. 1. The 2020 audit guidance, which cites ISO 19011:2018 and ISO/IEC 27001:2013. 2. The current ISO/IEC 27001:2022 requirement a 2026 audit may use. 3. The DIS alignment, which is an inference where the annex text is not public.
Current external reference: ISO/IEC 27001:2022
This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.
To set the ISMS scope the organization decides its boundaries and where it applies. In doing so it takes into account the issues identified under 4.1, the requirements identified under 4.2, and the interfaces and dependencies between its own activities and those carried out by other organizations. The resulting scope has to exist as documented information.
How the 2020 guidance taught the audit
Auditors confirm that the organization has itself set the physical, informational, legal and organizational boundaries within which the ISMS applies, whether that is the whole organization or a chosen unit or function, and that the context (4.1), interested party requirements (4.2) and the interfaces and dependencies between its own activities and those performed by other organizations were properly considered when setting it. They check that risk assessment and treatment reflect the operations and cover the boundaries of the ISMS and the audit scope, that each scope has at least one Statement of Applicability, and that every control identified by risk management, whether from 27001 Annex A, a sector standard or the organization's own design, appears in it. Interfaces with services or activities only partly inside the scope, such as shared IT systems, databases, telecommunications or outsourced business functions, must be reflected in the ISMS and its risk assessment. The certification scope need not equal the ISMS scope, and the scope document must be created and controlled as documented information.
The DIS layer: the 2022 alignment
The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.
No substantive change. The scope still has to name the boundary, the applicability and the interfaces and dependencies, and it still has to be available as documented information.
Evidence an auditor asks for
- ScopeDocumented ISMS scope stating boundaries, inclusions and interfaces
- ScopeCertification scope statement, where one exists, compared with the ISMS scope
- ScopeStatement of Applicability for each scope
- ScopeRisk assessment entries for shared facilities and outsourced functions at the scope boundary
The questions an auditor will ask
Ask for the scope and compare it with the sites, systems and suppliers that actually carry the risk. A scope that excludes the shared service is the common gap.
Common gaps
- Scope boundaries vague, so it cannot be told whether a site, system or process is in or out
- Shared systems or outsourced functions at the boundary absent from the risk assessment
- Scope with no Statement of Applicability, or controls from risk treatment missing from it
- Scope document not under document control
Prepare before the next audit
Draw the boundary and list the interfaces and dependencies. Reconcile the scope with the SoA and the audit programme extent.
Cross-references
Held ISO/IEC 27007:2020 requirement set. https://www.iso.org/standard/77802.html
Retrieved 2026-10-19. 43 substantive clause records, the scope and terms page, and 26 Annex A audit-guidance rows, read from the held 2020 edition and its translation, retrieved 2026-10-19. The 27th annex row is the new 6.3 row. Used for the requirement and evidence text in our own words. The licensed text is not reproduced.