Scope

What this part of the catalogue does

Clause 1 describes the document as a catalogue of general-purpose security controls accompanied by guidance on implementing them, intended for use inside an ISMS that follows ISO/IEC 27001, for implementing controls based on internationally recognized good practice, and for developing an organization's own information security management guidelines.

What it means when you fill the register

The scope clause describes a reference set of generic controls with implementation guidance, for organisations that want to select and implement controls in an ISMS based on ISO/IEC 27001, and for organisations that want a common control reference without certification. It states that the document is not a management system standard and does not set management system requirements. For the attribute view the scope is the boundary: the attributes describe the controls in this catalogue, and adopting them does not extend the ISMS scope or create a new certification. A consultant who is asked to 'certify the attributes' should say this plainly. The site says it on the publication page, in the terms and in the free check result. The scope also answers a common consultancy question: can the attribute view be sold as a separate deliverable? It can be a useful one, provided the client understands that it is a view of the existing controls and not a new certification. Our kit prices it as a document set for that reason, and the terms say plainly that it does not certify anything.

Scope questions arrive as 'does this apply to us?'. The honest answer for the attribute guidance is that it applies if you use the control catalogue, and it does not create a certification duty. In practice the scope statement in the ISMS is unchanged, the control set is unchanged, and the only addition is a view. A consultant can say that in one sentence and then spend the time on the SoA, which is where the buyer's actual risk sits.

What to keep beside the register

• The clause reference and the edition you read, so a later reader can check it.
• The decision it supports, with an owner and a date.
• The link to the control rows it frames, so the clause is not an orphan page in the file.

This is a structural or introductory clause. It carries no control evidence of its own, and the site does not present it as a requirement.

Where this clause is used

• The five attributes
• All 93 controls
• The publication record
• The method