Use this before risk work starts, because every later document (risk register, applicability statement, audit plan) inherits the scope. You get two documents in a new folder, ./scope-statement-drafting/: the scope statement itself, a short document saying what the management system covers and why, ready for leadership to approve (scope-statement.md), and a table of every team, site, product and system marked in or out with the reason (boundary-table.md). This skill drafts for a human to review and sign; this skill never marks a control effective. Leadership decides the scope; the agent proposes it.

Inputs to gather

Read before asking: the org chart or team list, the product and service list, the architecture overview, cloud accounts and repositories, office and site list, the vendor list, customer contracts or security questionnaires that mention certification, and any group structure (parent, subsidiaries). Then ask the reader, in one message:

Why now: which customer, tender or regulator asked, and what do they expect the certificate to cover?
Which products or services earn the revenue those buyers care about?
Which teams, sites or legal entities do they hope to leave out, and why?

Step 1: write the sentence the buyer will read

Start from the end. Draft the one or two sentences that would appear on a certificate or in a trust page, for example "The information security management system supporting the development, operation and support of , delivered from and hosted in ." Point to "locations as listed in the boundary table" rather than naming regions that will change. The certification body issues the final wording; check the trust page against the certificate once issued. If that sentence does not cover what the buyer from question 1 actually buys, the scope is wrong before it is written. Excluding the product the customer uses is the most expensive mistake here: it is found after the audit is paid for.

Step 2: draw the boundary on five axes

For each axis, list what is in and what is out, with the source document for each line: