Step 1 of 6 · Plan
Set the scope Who you are and what applies to you.
Before anyone talks about measures, it has to be clear what you are actually responsible for. This step usually takes less than an hour.
What it is about
Many projects lose weeks because nobody wrote down at the start which sites, services and frameworks are in. Later the team argues about things nobody asked for. A clearly described scope saves those rounds, and it is the first thing an auditor asks for.
How you go about it
- You enter your sector, size and the package you want. From this, UniqSuite works out which frameworks may apply to you.
- You describe the scope: which sites, units and services are in, and which are not.
- You add the people involved, such as management, the information security officer and the people responsible in each area, and assign roles.
What UniqSuite does for you
- The questions come in a fixed order. You do not need to know which clause of the standard is meant.
- What you set here drives the following steps. The gap analysis then only shows the requirements that apply to you.
What you end up with
A scope report you can present to management and use in the audit.
Where the requirements come from
- ISO/IEC 27001, clause 4: context of the organisation, interested parties, scope
- ISO/IEC 27001, clause 5.3: roles and responsibilities
- German BSI Act (BSIG) section 28: classification as an essential or important entity
- BSIG section 33: registration duty
The references show where the requirements come from. They do not replace a legal assessment.
How far along are you with this step?
The quick check shows you in two minutes. Or let us show you UniqSuite with your own questions.