# Clause 4.3.2: Scope of the business continuity management system

State which parts of the organization are inside the BCMS having regard to location, size, nature and complexity, identify the products and services covered, and document and explain every exclusion so that no exclusion undercuts the organization's ability or responsibility to deliver continuity as established by the business impact analysis, the risk assessment and applicable law.

Cloud: A defensible scope names the business activities, the cloud services that support them, the locations involved and the interfaces to anything excluded. Exclusions need a reason, because an excluded backup region is exactly where an incident will go next.

Evidence: List of in scope sites, entities and functions; List of in scope products and services; Exclusion log with the explanation for each exclusion; Cross check that no exclusion contradicts the business impact analysis or a legal obligation.

Test: Check that every exclusion carries a reason and a named owner.

Citation: ISO 22301:2019, clause 4.3.2. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.