4.3.1 General
Determine the boundaries and applicability of the BCMS from the context issues, the interested party requirements and the organization's own mission, goals and internal and external obligations, and hold the resulting sc
3
artefacts
1
held by a system
0
at each review
moderate
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Version history showing the scope has been maintained · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Scope document referencing the context issues and party requirements it was derived from · Policy repository / GRC workspace
- Evidence of management approval of the scope · Policy repository / GRC workspace
First move
Start with the 1 of 3 artefacts that already live in a system (Policy repository / GRC workspace); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Scope asserted without any traceable derivation from context or obligations
- Mission and external obligations ignored, so scope is drawn on organizational convenience
- Scope never re-derived after the context analysis changed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet4.3 Determining the scope of the business continuity management system · 4.3.2 Scope of the business continuity management system