ISO/IEC 27001:2022 scope and certification

ISO/IEC 27001 is a management system standard. Audits focus on whether your ISMS works in practice: governance, risk management, control execution, and continual improvement.

This page is a practical guide to defining scope and preparing for certification-style audits without turning ISO/IEC 27001 into a documentation sprint.

What an ISMS is

An ISMS is the set of policies, processes, controls, and evidence that manages information security risk across an organization.

Define scope you can defend

In ISO work, scoping is not a formality. Your scope determines what auditors will sample, which systems matter, and what evidence you must be able to produce.

Good scopes are:

• specific (what is included/excluded)
• operational (who is accountable and what processes apply)
• reviewable (how scope changes are approved and recorded)

For AI systems, scope often extends beyond the model into the operational environment (infrastructure, vendors, data pipelines, and incident handling).

What auditors typically expect

At a high level:

• defined scope and asset boundaries
• risk assessment process and treatment decisions
• security controls implemented and executed
• evidence of operation (logs, reviews, training, incident handling)
• internal audits and management reviews that drive improvement

Governance loop

Four stations, one operating model.

ISMS audit loop

Certification readiness is an operating cadence.

Plan

Define scope, policy, and risk method

Operate

Run controls and collect evidence

Assure

Internal audits and management review

Improve

Corrective actions and updates

The dashed arc marks restart — every cycle re-enters Plan with what changed since the last pass.

Audit pack

How four export types collapse into one shippable bundle.

Inputs

Project PDF export

Top controls (PDF exports)

Evidence files (attachments)

Key assets (Markdown exports)

Audit pack

Single shippable bundle

All four input types, versioned together, ready for the auditor.

Snapshot

Exports are snapshots. Keep scope stable before exporting — the bundle freezes whatever was in place at export time.

Annex A is a reference, not a checklist

Audits usually test operation and evidence. Use Annex A to structure controls, but keep selection and exclusions tied to scope and risk.

Disclaimer

This page is for general informational purposes and does not constitute legal advice.