Scoping an ISO 27001 programme: what to settle before work begins

When an ISO/IEC 27001 programme takes longer or demands more effort than expected, the cause is often found in decisions made, or not made, before work started. An unclear scope, an optimistic view of existing controls or an informal understanding of who does what can each add work later. Settling these points early, and recording them, gives the organisation and anyone supporting it a shared basis for planning.

Why programmes drift from their original plan

ISO/IEC 27001:2022 requires an organisation to understand its context, determine the scope of its Information Security Management System (ISMS), assess and treat information security risks, and operate and improve the system over time [1]. Each of these can expand if it is not bounded. Common sources of drift include a scope that widens as stakeholders add systems or sites, a risk assessment that uncovers more remediation than anticipated, controls that exist in practice but lack evidence, and internal staff who have less time available than planned.

Defining the ISMS scope

The standard requires the scope to be determined and documented, taking account of internal and external issues, the requirements of interested parties, and interfaces and dependencies with activities performed by others [1]. In practice, a well-defined scope names the products or services covered, the locations and teams involved, the technology environments in scope and the relevant third parties.

Scope should reflect what customers and other interested parties actually need assurance about. A scope that is too narrow may not satisfy the customers who prompted the work, because the certificate states what was audited and buyers can check it through public registers such as IAF CertSearch [5]. A scope that is too broad adds work and audit effort without a corresponding benefit. The number of people within the scope is also one of the factors a certification body uses when determining audit time under ISO/IEC 27006-1:2024 [6].

Establishing your starting position

A gap assessment against the clauses of ISO/IEC 27001 and the reference controls in Annex A, with implementation guidance drawn from ISO/IEC 27002:2022, gives a realistic view of what exists and what needs to be built [1] [2]. The distinction that matters most is between controls that are documented and operating with evidence, controls that operate informally without records, and controls that do not yet exist. The second category is frequently larger than expected and is where much unplanned effort originates.

Questions to settle in writing before work begins

1. What is the proposed ISMS scope, and who in management has approved it?
2. What is the agreed starting position, based on a documented gap assessment?
3. Which deliverables will be produced, who owns each one, and what does complete mean for each?
4. Which tasks will internal staff carry out, and how much of their time is realistically available?
5. Who will perform the internal audit, and how will their objectivity and impartiality be ensured?
6. Who is the named lead for any external support, and who else will work on the programme?
7. How will changes to scope or deliverables be proposed, assessed and agreed?
8. Which certification body will be approached, and at what point?
9. What support, if any, is expected during the Stage 1 and Stage 2 audits and in responding to findings?

Recording the answers does not remove uncertainty, but it makes changes visible. When the scope or the starting position changes, everyone can see why the plan needs to change with it.

Choosing and engaging a certification body

ISO does not certify organisations. Certification is carried out by independent certification bodies [3]. In the UK, the United Kingdom Accreditation Service (UKAS) accredits certification bodies as competent to audit and certify management systems [4]. Accredited ISMS certification bodies work to ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024, which govern how audits are planned, how audit time is determined and how certification decisions are made [6] [7].

When comparing certification bodies, it is reasonable to ask about their accreditation for ISO/IEC 27001, their experience in your sector, auditor availability and how they will structure the Stage 1 and Stage 2 audits. The certification body is independent of any consultant supporting you, so its audit plan and decisions are its own. It should be engaged directly by the organisation seeking certification.

Keeping the programme on course

Once work begins, regular review against the agreed scope, deliverables and internal capacity helps identify drift early. Where the gap assessment turns out to be optimistic, it is better to revise the plan openly than to compress the time controls have to operate before audit. A programme that reflects the organisation's real position is easier to sustain through surveillance audits and recertification than one built around a target date.

Support is available for organisations scoping an ISO/IEC 27001:2022 programme and carrying out an initial gap assessment.