The boundaries of a management system: the parts of the organization, locations, assets, and activities it covers.
The scope defines what a management system applies to and, by implication, what it does not. It names the organizational units, sites, services, and technologies that are inside the system, taking account of internal and external issues and the needs of interested parties.
A clear scope is essential for certification, because the audit and the certificate apply only to what the scope describes. A scope that is too narrow can leave real risks ungoverned.
KaitoSec