---
notetype: reference
standard: ISO 27001
version: 2022
language: EN
type: clause
id: "C.4.3"
title: "Determining the scope of the information security management system"
tags:
- iso27001/2022/EN
- sourcetext
status: active
---
## 4.3 Determining the scope of the information security management system

The organization shall determine the boundaries and applicability of the information security management system to establish its scope.

When determining this scope, the organization shall consider:

a\) the external and internal issues referred to in [4.1](c-4.1-Understanding-the-organization-and-its-context.md);

b\) the requirements referred to in [4.2](../../MoCs/ISO_27001_2022_4.2_MoC%20Understanding%20the%20needs%20and%20expectations%20of%20interested%20parties.md);

c\) interfaces and dependencies between activities performed by the organization, and those that are performed by other organizations.

The scope shall be available as documented information.