ISO Programme Scoping Checklist: What to Have Ready Before the Call

• The standard or standards you are aiming for, and who asked: a customer, a tender, a regulator's expectation or your own board.
• The exact wording of the request if you have it, since a customer asking about information security, personal data, continuity or AI governance points to a different standard.
• Whether you want more than one. The ISO management system standards share a structure, so risk assessment, internal audit and management review can run once, and certification bodies commonly audit ISO 27001 together with another standard, which reduces audit days.

• Every site inside the boundary, including home-based or remote teams, with the city it is in and what happens there.
• Headcount inside the boundary, split into employees and contractors. Training, access reviews and role definitions scale with people, and certification bodies price audit days partly on organisation size.

For ISO 27001, SecureRoot's published total to certificate is ₹1.5 lakh to ₹8 lakh, covering our programme and the certification body's Stage 1 and Stage 2 audit, which you contract and pay directly. A single office with one product sits near the bottom of that band; a multi-location operation starting from nothing sits near the top.

1. 01

   ISO 27701 (privacy information management)

   Whether you act as a controller, a processor or both, and the main processing activities and data flows in scope, described by category rather than by sending data. Say whether you hold or are building ISO 27001, since building both on one control set usually lowers the total. SecureRoot also helps you choose a certification body accredited for ISO 27701.

2. 02

   ISO 22301 (business continuity)

   The critical activities and services you would need to restore first, the sites and business units involved, any existing disaster recovery or continuity plans, and any recent exercises. If you are a regulated entity, say which regulator's continuity expectations apply to you.

3. 03

   ISO 42001 (AI management)

   A rough list of the AI systems you build, provide or use, including third-party AI tools staff rely on, and whether you are a provider, a deployer or both. Say whether you want to certify one product or the whole organisation; a narrow first scope is common.

The current editions are ISO/IEC 27701:2025, ISO 22301:2019 and ISO/IEC 42001:2023. ISO lists ISO 22301:2019 as due for revision, so ask whether a new edition could land during your programme.

These three are priced after scoping rather than from a published band. The certification body's two-stage audit is paid by you, and SecureRoot's published timeline for each is four to six months to a first certificate.