ISO 27001 Scope in the UAE: How to Define Your ISMS Before Anything Else

Every later step depends on the scope of your information security management system (ISMS): the risk assessment, the controls you choose, the evidence you collect and the size of the audit. Get it wrong and you either certify something that does not matter, or you take on far more than you can run.

First, which version of the standard?

The current edition is ISO/IEC 27001:2022 ¹. The transition period for the 2013 edition ended on 31 October 2025, and certifications to the 2013 edition have expired or been withdrawn ². Any new project should be built against the 2022 edition.

The 2022 edition also reorganised Annex A. The control set went from 114 controls in 14 groups to 93 controls in four themes: organisational, people, physical and technological. We come back to this at the Statement of Applicability.

In 2024, ISO published a short amendment on climate change ³. Clause 4.1 now asks you to decide whether climate change is a relevant issue for your organisation, and clause 4.2 notes that interested parties can have climate-related requirements. Both feed into scope, so record your answer even if it is "not relevant".

What does scope actually include?

An ISMS scope statement answers four questions:

• Which part of the organisation? The whole company, one business unit, or one service.
• Which locations? One office, several sites, or remote teams.
• Which systems and data? The platforms, networks and information you want protected.
• Which dependencies? Cloud providers, outsourced IT and other suppliers that your in-scope service relies on.

The last question matters because clause 4.3 asks you to consider the interfaces and dependencies between your activities and those of other organisations. The auditor reads the scope statement first, and everything else in the audit is tested against it.

Three ways to get the scope wrong

1. Too wide

Including the whole company "to be safe" sounds responsible. In practice it multiplies the people, systems and evidence you must manage. In our experience, a first certification covering many teams and sites often stalls because nothing is stable enough to audit.

2. Too narrow

A scope that covers one small system can be easy to certify but meaningless to the client who asked for it. If a tender requires ISO 27001 for the service you deliver, the scope has to include that service, its data and the people who run it.

3. Ignoring suppliers

Your service may depend on a cloud host, a managed IT provider or a payment processor. These do not have to be inside your scope, but you must show how you manage the risk they bring. Leaving suppliers out of the picture is a frequent source of audit findings, and our vendor and third-party risk practice covers this in more depth.

A simple way to choose your scope

Start from the reason you want certification, then work backwards.

A phased approach is often the most realistic. Certify a well-defined core, run it properly, then widen the scope at a surveillance or recertification audit.

From scope to the Statement of Applicability

Once the scope is fixed, you run a risk assessment inside it. The results tell you which Annex A controls apply.

The Statement of Applicability (SoA) lists all 93 controls, states whether each one applies, and gives a reason for each inclusion or exclusion.

Two rules keep the SoA honest:

• Exclusions need a reason tied to your risk assessment. "We don't need it" is not a justification. "We have no physical media in scope" is.
• Included controls need evidence. Listing a control is easy; showing that it works is what the audit tests. A system that only works on audit day tends to struggle later, as we explain in the 8 things every surveillance audit must cover.

ISO 27001 and UAE data protection law

Companies in the UAE often ask whether ISO 27001 makes them compliant with data protection law. It does not. ISO 27001 is a management system standard that gives you a structured way to manage information security risk, which supports legal compliance.

Which law applies depends on where you operate. Onshore, it is the federal Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 ⁴. In the financial free zones, the DIFC Data Protection Law ⁵ and the ADGM Data Protection Regulations ⁶ apply instead.

Your sector can add its own information security expectations. Government entities and their suppliers may work to SIA (formerly NESA) frameworks, financial firms answer to the CBUAE, DFSA or ADGM FSRA, and Abu Dhabi healthcare providers work to ADHICS from the Department of Health.

Certification is not a legal opinion. If you handle personal data or work in a regulated sector, confirm the legal requirements separately and make sure your scope covers the systems and data they refer to.

A short scoping checklist

Before you commit to a plan, make sure you can answer these:

• Why do we want certification, and who is asking for it?
• Which service, unit or location is in scope?
• Which systems and data does that service depend on?
• Which suppliers touch it, and how do we manage their risk?
• Who owns the ISMS, and who signs off the scope?
• Can we run this scope properly for a full year, not only on audit day?

Who decides what

Your consultant can help you set a sensible scope and build the system. The certification body audits it and makes the certification decision. We explain the split in consultancy, certification and accreditation: who decides what.

If you already run other ISO standards

If you already run ISO 9001, ISO 14001 or ISO 45001, you do not need to start from zero. ISO 27001 follows the same management system structure, so policy, internal audit, management review and corrective action can be shared through an integrated management system. Our overview of ISO certification and management systems explains the wider route.

Organisations that also need services to keep running through a disruption often pair ISO 27001 with business continuity under ISO 22301 and NCEMA 7000.

ISO 27001 scope: common questions

What is an ISO 27001 scope statement?

It is a short documented statement of what your ISMS covers: the parts of the organisation, locations, systems, data and dependencies. It does not decide which controls apply; that comes from the risk assessment and the Statement of Applicability. See our ISO 27001 consulting page for how the work is built.

Does the ISO 27001 scope have to cover the whole company?

No. You can certify one service, business unit or location, as long as the scope matches the reason you need certification and its boundaries are clear. A narrow scope will not satisfy a client who needs the whole service covered, so check what they asked for first.

Can we change the ISO 27001 scope after certification?

Yes. The scope can be widened or reduced, and the certification body reviews the change, usually at a surveillance or recertification audit. The decision on the change is theirs, so agree it with them before you plan the work. Read who decides what for the split of roles.

Do suppliers need to be inside the ISO 27001 scope?

Not usually. Cloud hosts and managed IT providers can stay outside the scope, but you must still show how you manage the risk they bring to the services that are in scope. Our vendor and third-party risk page covers how that is done.

What this means for your organisation

Scope is the cheapest decision in an ISO 27001 project and the most expensive one to fix later. Spend time on it first, tie it to the real reason you need certification, and be honest about what you can run all year.

If you are planning ISO 27001, ask us for a scope and gap review against ISO/IEC 27001:2022 through the contact form (ISO 27001 pre-selected) or on WhatsApp, and a senior practitioner will respond.