Scope a second framework without copying the first

Objectives

Sales needs an ISO 27001 certificate. Your VP says: "copy the SOC 2 scope, it's the same controls, just get the attestation done by July".

Two of the words in that sentence belong to a different framework. Write the scoping record for the ISO engagement: the right standard version, the right kind of engagement, the right evidence basis, the systems genuinely in scope, and the controls whose evidence can be reused.

Existing SOC 2 Type II scope (period 2026-01-01 → 2026-06-30):
  prod-aws, okta, github, marketing-site

marketing-site: static brochure pages, no customer data, no auth,
  included in SOC 2 only because it shares the AWS account.
  The ISO risk assessment excludes it.

ISO 27001 published versions: 2013 (withdrawn), 2022 (current)
Engagement kinds: attestation | certification | readiness
Evidence bases: period | point_in_time

Controls with evidence already collected: IA-MFA-ADMIN,
  CM-CHANGE-APPROVAL, EV-BACKUP-RESTORE

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Re-read the brief and name the trap

   Your VP used SOC 2 vocabulary for an ISO engagement and assumed scope transfers unchanged. Both assumptions are load-bearing and both are wrong.

   The record you write is the artefact that stops the wrong assumption reaching the auditor.

2. Step 2

   Version and engagement kind

   The fixture marks one version as withdrawn. Certifying against a withdrawn standard is not an option, however many of your policies still cite it.

   Then choose the engagement kind that a certification body performs, rather than the one a public accounting firm performs.

   Uses the current ISO 27001 versionEngagement kind is the ISO one

3. Step 3

   Evidence basis follows the engagement

   Ask what the auditor is forming an opinion about: how controls operated across a window, or whether the management system meets the standard when examined.

   The fixture gives you exactly two permitted values and the SOC 2 line above shows which one belongs to the other framework.

   Evidence basis matches the engagement

4. Step 4

   Re-derive the scope

   Scope follows the risk assessment for this framework, not the account boundary that happened to be convenient last time. One of the four systems has a note explaining why it was in the SOC 2 scope and why ISO does not want it.

   Keep the rest in the order the fixture lists them.

   Scope drops the system ISO excludes

5. Step 5

   Reuse is a list, not a claim

   "All" is unverifiable and will be treated as zero by whoever plans the fieldwork. Name the control identifiers whose collected evidence you intend to present again.

   Only reuse evidence for controls that survive the new scope.

   Reuse names specific controls

Rules summary

• XP on pass

  30 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 8 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.