ISMS Scope Extension and Multi-Site Plan Template (ISO/IEC 27001)

Scope Extension and Multi-Site Plan: [Organization name] ISMS

Plans a change to the certified scope of an information security management system (ISMS): adding sites, services, products, legal entities or countries, reducing scope, or moving a multi-site organization onto one certificate. It supports ISO/IEC 27001:2022 + Amd 1:2024 clauses 4.3 (scope), 6.3 (planning of changes) and 8.1, and prepares the conversation with the certification body, which applies ISO/IEC 17021-1:2015, ISO/IEC 27006-1:2024 and the accreditation community's multi-site mandatory document (IAF MD 1, now carried over by Global ACI as Global ACI-TECH-3-001). Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

• 1. Purpose and trigger
• 2. What changes in the scope
• 3. Impact on the ISMS
• 4. Multi-site eligibility and the central function
• 5. Site register and sampling groups
• 6. Site readiness checklist
• 7. Notification and engagement with the certification body
• 8. Plan and timeline
• 9. Scope reduction and site removal
• 10. Size tiers
• 11. Records and evidence
• 12. References
• Standard and licence note

1. Purpose and trigger

This plan governs the change of the ISMS scope described below, from the decision to extend (or reduce) through the certification body's decision to amend the certificate. It makes sure the change is planned (clause 6.3), that the new boundary is documented (clause 4.3), that operational controls are in place before the new part is declared in scope (clause 8.1), and that the certification body is told in time.

Example (Quillmere Group): the group certified its HQ, data centre and service centre in phase 1 and now extends the certificate to its three plants (phase 2), because two automotive customers require the plants to be named on the certificate by YYYY-MM-DD. Decision recorded in steering committee minute SC-2027-04.

2. What changes in the scope

2.1 Scope statements

2.2 Change classification

Define what counts as a scope change for your certificate. Typical examples: a new permanent site, a new legal entity, a new country, a new service offered to customers, a new production hosting region, and removing any of these. A new team inside an existing site and service usually does not change the certificate, but it still goes through the ISMS change process (isms/isms-change-plan).

3. Impact on the ISMS

Run the change through each element of the ISMS and record the update.

Climate-related issues: since Amd 1:2024 the context analysis must take a position on climate change (4.1) and look for stakeholder demands linked to it (4.2). A new plant in a flood-prone area, or a data centre with cooling constraints, can make this a real input to the risk assessment rather than a one-line statement.

4. Multi-site eligibility and the central function

A multi-site organization runs one management system across several sites under the authority of a central function. The certification body decides whether the multi-site approach, and site sampling within it, can be used. It applies ISO/IEC 17021-1, the ISMS-specific requirements of ISO/IEC 27006-1:2024 (which take precedence for ISMS), and the general multi-site mandatory document. That document was issued by the International Accreditation Forum as IAF MD 1:2023 and, after IAF's role passed to the Global Accreditation Cooperation Incorporated (Global ACI), was re-issued as Global ACI-TECH-3-001 version 1.0 (issued 2026-07-10, implementation 2026-08-28).

4.1 Self-assessment of eligibility

The criteria below are written in this template's own words. Read the official documents and confirm with your CB.

The central function does not have to sit in one building. It is the place where top management authority over every site is exercised, for example the group security office plus the group steering committee.

4.2 Consequences of a nonconformity at one site

Plan for this before the audit. Under the multi-site rules, a nonconformity found at one site (by your own internal audit or by the CB) must be analysed to decide whether it reflects a system-wide weakness. If it does, correct it at the central function and at every affected site; if it does not, record why the follow-up is limited. A major nonconformity open at any site at the time of the certification decision holds back certification of the whole multi-site organization, and removing the problem site from the scope during the process to avoid this is not accepted. This is why section 6 makes each new site pass an internal audit before the CB sees it.

5. Site register and sampling groups

5.1 Site register

Quillmere Group has 2,400 staff across these 6 sites in 4 countries. Fill the headcount column from HR data on the same date for every site, and make sure the figures add up to the group total you declare on the CB application form: audit time depends on it.

5.2 How sampling usually works (for planning only)

The general multi-site document lets the CB sample sites only where they perform very similar activities, and requires the CB to have its own documented rules that restrict sampling where risk or complexity is high. Its general approach sets a minimum sample from the square root of the number of sites in a group (rounded up), with a reduced factor for surveillance, at least a quarter of the sample chosen at random, and the central function audited at initial certification, every recertification and at least once each calendar year. Sites that cannot be sampled are audited in full at initial certification and recertification and in part during surveillance. ISO/IEC 27006-1:2024 sets ISMS-specific multi-site requirements that take precedence, so your CB may apply different or additional rules.

Treat these figures as a planning aid for budget and site preparation. Do not quote them to management as commitments until the CB confirms them in writing in the audit programme.

6. Site readiness checklist

How long the site must operate before the CB visits is not fixed by ISO/IEC 27001. It is CB practice to expect records that show the controls working, so plan at least one full cycle of the recurring controls (access review, backup test, vulnerability scan) at the new site.

7. Notification and engagement with the certification body

The certification agreement required by ISO/IEC 17021-1 makes the certified client responsible for informing the CB promptly of matters that can affect the ISMS's ability to keep meeting the requirements. In practice this covers changes to legal status, ownership or commercial standing; organization and top management; contact address and sites; the scope of activities covered; and major changes to the ISMS and its processes. Check the exact list in your contract.

7.1 Notification log

7.2 Information the CB usually asks for

• Updated application form: legal entities, sites with addresses, activities per site, persons doing work under the organization's control per site, shift patterns, and outsourced processes.
• Proposed scope wording and the revised SoA version.
• Evidence that the central function controls the new sites (section 4).
• Readiness status per site (section 6) and the internal audit report.
• Preferred dates, languages spoken at the site and any safety or access constraints (for example, OT areas that need escorted access).

7.3 How the CB may handle the extension

The CB decides the route, and it may differ from what you propose:

Whatever the route, the certificate is amended only after the CB's certification decision. Do not advertise the extended scope before the amended certificate is issued (isms/certification-mark-usage).

8. Plan and timeline

8.1 Budget

Use local currency where you budget. Feed the total into the budget and resource plan (isms/isms-budget-resource-plan).

9. Scope reduction and site removal

When a site leaves, check that customer contracts, trust centre pages and marketing material no longer claim it is certified.

10. Size tiers

11. Records and evidence

Retention periods are examples: set them in the documented information register (isms/isms-documented-information-register) and align with legal requirements. Map each record to its evidence owner in isms/control-evidence-matrix.

12. References

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 4.3, 6.3 and 8.1), ISO/IEC 17021-1:2015, ISO/IEC 27006-1:2024 and the multi-site mandatory document Global ACI-TECH-3-001 (based on IAF MD 1:2023). The text, tables, criteria wording and examples are original; no ISO, IEC, IAF or Global ACI text is reproduced, and the eligibility criteria and sampling rules are paraphrased for planning only. Read the official standards and mandatory documents, and follow your certification body's procedures, which decide sampling, audit time and the route of any extension. Check the current editions before use: the accreditation mandatory documents were renumbered under Global ACI in 2026. Official ISO text, purchase or licensed access: https://www.iso.org/standard/82875.html, https://www.iso.org/standard/61651.html and https://www.iso.org/standard/82908.html. This is a documentation format, not certification advice.

Template licence: MIT.