# Scope Extension and Multi-Site Plan: [Organization name] ISMS

> Plans a change to the certified scope of an information security
> management system (ISMS): adding sites, services, products, legal
> entities or countries, reducing scope, or moving a multi-site
> organization onto one certificate. It supports ISO/IEC 27001:2022 +
> Amd 1:2024 clauses 4.3 (scope), 6.3 (planning of changes) and 8.1,
> and prepares the conversation with the certification body, which
> applies ISO/IEC 17021-1:2015, ISO/IEC 27006-1:2024 and the
> accreditation community's multi-site mandatory document (IAF MD 1,
> now carried over by Global ACI as Global ACI-TECH-3-001). Replace
> every `[bracketed]` value and every row marked *Example*.

<!--
Guidance: How to use this template
- Use it when the business is about to change what the certificate
  covers: a new office or plant, an acquisition, a new product line or
  managed service, a new hosting region, a new legal entity, or a
  decision to drop part of the scope. Also use it once at the start of
  a phased, site-by-site certification of a group.
- Fill section 2 (what changes) and section 4 (eligibility of the
  central function) first. If the central function cannot show it
  controls every site, multi-site certification is not available and
  the rest of the plan changes.
- The main pitfall is treating the extension as paperwork: updating
  the scope statement without running the new site or service through
  risk assessment, the SoA, internal audit and management review
  before the certification body arrives.
- Sampling, audit time and whether a new site is audited before it is
  added are decisions of the certification body. Every number in this
  template is an Example.
- Related templates: `compliance/ms-scope`, `isms/certification-cycle-plan`,
  `isms/certification-body-selection`, `isms/isms-change-plan`,
  `compliance/statement-of-applicability`, `compliance/internal-audit-program`,
  `isms/control-evidence-matrix`, `isms/surveillance-readiness-health-check`.
-->

## Document control

<!-- Guidance: One plan per extension project. A group running several extensions in parallel keeps one plan per change and links them from the certification cycle plan (DOC-ISMS-094). -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-095 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Closed] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@top-management-sponsor], [@site-managers] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; ISO/IEC 17021-1:2015; ISO/IEC 27006-1:2024; Global ACI-TECH-3-001 v1.0 (based on IAF MD 1:2023) |
| Next scheduled review | [YYYY-MM-DD, or at closure of the extension] |
| Current certificate | [Certificate number, issue date, expiry date] |
| Certification body | [CB name] (accredited by [accreditation body], a signatory of the Global ACI MRA, formerly IAF MLA) |
| Change type | [New site / New service / New legal entity / New country / Scope reduction / Multi-site consolidation] |
| Linked documents | ISMS scope DOC-ISMS-002, ISMS change plan DOC-ISMS-025, Certification cycle plan DOC-ISMS-094, SoA DOC-ISMS-011 |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Top management sponsor | [@sponsor] | [Approved / Approved with changes] | YYYY-MM-DD |
| Site or service owner | [@site-manager] | [Agreed] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | YYYY-MM-DD | [@isms-manager] | First issue |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |

## Contents

- [1. Purpose and trigger](#1-purpose-and-trigger)
- [2. What changes in the scope](#2-what-changes-in-the-scope)
- [3. Impact on the ISMS](#3-impact-on-the-isms)
- [4. Multi-site eligibility and the central function](#4-multi-site-eligibility-and-the-central-function)
- [5. Site register and sampling groups](#5-site-register-and-sampling-groups)
- [6. Site readiness checklist](#6-site-readiness-checklist)
- [7. Notification and engagement with the certification body](#7-notification-and-engagement-with-the-certification-body)
- [8. Plan and timeline](#8-plan-and-timeline)
- [9. Scope reduction and site removal](#9-scope-reduction-and-site-removal)
- [10. Size tiers](#10-size-tiers)
- [11. Records and evidence](#11-records-and-evidence)
- [12. References](#12-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Purpose and trigger

<!-- Guidance: State in two or three sentences why the scope changes now and what business outcome depends on it (a customer contract, an acquisition close, a tender). Auditors ask whether the change was planned under clause 6.3 or discovered after the fact. -->

This plan governs the change of the ISMS scope described below, from
the decision to extend (or reduce) through the certification body's
decision to amend the certificate. It makes sure the change is planned
(clause 6.3), that the new boundary is documented (clause 4.3), that
operational controls are in place before the new part is declared in
scope (clause 8.1), and that the certification body is told in time.

| Field | Entry |
|---|---|
| Trigger | [Acquisition / New site opened / Customer requirement / New service launched / Regulatory requirement / Phased certification] |
| Business driver | [e.g. tender requires certificate to name the new plant] |
| Required date on the certificate | [YYYY-MM-DD] |
| Decision taken by | [Steering committee, minute reference] |
| Sponsor | [@sponsor] |

*Example (Quillmere Group):* the group certified its HQ, data centre and
service centre in phase 1 and now extends the certificate to its three
plants (phase 2), because two automotive customers require the plants
to be named on the certificate by YYYY-MM-DD. Decision recorded in
steering committee minute SC-2027-04.

## 2. What changes in the scope

<!-- Guidance: Write the current and the proposed scope statements side by side, word for word. The certificate text is derived from this table, so be exact about legal entity names, addresses and services. Pitfall: extending the statement but forgetting the interfaces (shared services, suppliers, cloud tenants) that now cross the boundary. -->

### 2.1 Scope statements

| Element | Current certified scope | Proposed scope |
|---|---|---|
| Scope statement (certificate wording) | [Current text] | [Proposed text] |
| Legal entities | [Entity A] | [Entity A, Entity B] |
| Sites (address) | [List] | [List with new sites marked NEW] |
| Services and products | [List] | [List with additions marked NEW] |
| Technology boundary | [Cloud tenants, regions, data centres] | [Additions] |
| SoA version | [vX.Y, date] | [vX.Z, planned date] |
| Exclusions | [None / list] | [None / list] |

### 2.2 Change classification

| ID | Change | Type | Interfaces and dependencies | Risk to the ISMS |
|---|---|---|---|---|
| EXT-001 *(Example)* | Add Plant A, Plant B, Plant C (phase 2) | New sites | Group SOC at HQ, ERP in group data centre, OT networks at each plant | High: OT environments not yet covered by the risk assessment |
| EXT-002 *(Example)* | Add the newly acquired service subsidiary as a legal entity | New legal entity | Separate identity provider, own suppliers | Medium: integration of identity and supplier controls |
| EXT-003 | [Change] | [Type] | [Interfaces] | [Low / Medium / High] |

Define what counts as a scope change for your certificate. Typical
examples: a new permanent site, a new legal entity, a new country, a
new service offered to customers, a new production hosting region, and
removing any of these. A new team inside an existing site and service
usually does not change the certificate, but it still goes through the
ISMS change process (`isms/isms-change-plan`).

## 3. Impact on the ISMS

<!-- Guidance: Walk through the clauses and update every document the change touches. An auditor will pick one new site and trace it through context, risk, SoA, competence, internal audit and management review. -->

Run the change through each element of the ISMS and record the update.

| ISMS element | Clause or control | Update required | Owner | Status |
|---|---|---|---|---|
| Context and interested parties (DOC-ISMS-003) | 4.1, 4.2 | New local legal requirements, local customers and regulators, climate-related issues at the new site where relevant (Amd 1:2024) | [@isms-manager] | [Open / Done] |
| Scope (DOC-ISMS-002) | 4.3 | New boundary, interfaces and dependencies | [@isms-manager] | [Open / Done] |
| Legal register (DOC-ISMS-014) | 4.2, A.5.31 | Data protection, labour, sector and export rules of the new country | [@legal] | [Open / Done] |
| Asset inventory (DOC-ISMS-012) | A.5.9 | New information assets, systems and OT assets | [@site-it] | [Open / Done] |
| Risk assessment and register (DOC-ISMS-016) | 6.1.2, 8.2 | Assess new risks with the approved method (DOC-ISMS-010) | [@risk-owner] | [Open / Done] |
| Risk treatment plan (DOC-ISMS-013) | 6.1.3, 8.3 | Treatments for new risks, owners, dates | [@risk-owner] | [Open / Done] |
| Statement of Applicability (DOC-ISMS-011) | 6.1.3 d | Revisit applicability: physical controls A.7, OT-relevant A.8 controls, site-specific exclusions | [@isms-manager] | [Open / Done] |
| Objectives (DOC-ISMS-024) | 6.2 | Site-level objectives where needed | [@site-manager] | [Open / Done] |
| Roles and RACI (DOC-ISMS-006) | 5.3 | Site security coordinator, local incident contact | [@ciso] | [Open / Done] |
| Competence and awareness (DOC-ISMS-026) | 7.2, 7.3 | Onboarding training for all staff at the new site | [@hr] | [Open / Done] |
| Documented information (DOC-ISMS-028) | 7.5 | Local procedures registered, translations controlled | [@doc-controller] | [Open / Done] |
| Internal audit (DOC-ISMS-082) | 9.2 | Audit of the new site before the CB visit | [@internal-audit] | [Open / Done] |
| Management review (DOC-ISMS-085) | 9.3 | Review covers the extension and its readiness | [@sponsor] | [Open / Done] |
| Control evidence matrix (DOC-ISMS-033) | All | Evidence owners and locations for the new site | [@isms-manager] | [Open / Done] |

Climate-related issues: since Amd 1:2024 the context analysis must take
a position on climate change (4.1) and look for stakeholder demands
linked to it (4.2). A new
plant in a flood-prone area, or a data centre with cooling constraints,
can make this a real input to the risk assessment rather than a
one-line statement.

## 4. Multi-site eligibility and the central function

<!-- Guidance: Complete this section whenever the certificate covers, or will cover, more than one site. If any criterion is "No", talk to the CB before you go further: each site may then need a full audit, which changes cost and timeline. -->

A multi-site organization runs one management system across several
sites under the authority of a central function. The certification body
decides whether the multi-site approach, and site sampling within it,
can be used. It applies ISO/IEC 17021-1, the ISMS-specific requirements
of ISO/IEC 27006-1:2024 (which take precedence for ISMS), and the
general multi-site mandatory document. That document was issued by the
International Accreditation Forum as IAF MD 1:2023 and, after IAF's role
passed to the Global Accreditation Cooperation Incorporated (Global ACI),
was re-issued as Global ACI-TECH-3-001
version 1.0 (issued 2026-07-10, implementation 2026-08-28).

### 4.1 Self-assessment of eligibility

The criteria below are written in this template's own words. Read the
official documents and confirm with your CB.

| # | Criterion (paraphrased) | Evidence | Met? |
|---|---|---|---|
| E1 | One single ISMS covers all sites: same policy, risk method, SoA, documented information and improvement process | Policy framework DOC-ISMS-005, SoA DOC-ISMS-011 | [Yes / No] |
| E2 | A central function is identified, is part of the organization (not outsourced) and has authority to define and maintain the ISMS | RACI DOC-ISMS-006, steering committee charter DOC-ISMS-007 | [Yes / No] |
| E3 | One management review covers the whole ISMS, including every site | Management review minutes DOC-ISMS-085 | [Yes / No] |
| E4 | Every site is in the internal audit programme | Internal audit programme DOC-ISMS-082 | [Yes / No] |
| E5 | The central function collects and analyses data from all sites (incidents, metrics, audit results, corrective actions, legal changes) and can require change at any site | Performance report DOC-ISMS-081, corrective action records DOC-ISMS-087 | [Yes / No] |
| E6 | Legal or contractual links bind each site to the central function | Group structure chart, intra-group agreements | [Yes / No] |

The central function does not have to sit in one building. It is the
place where top management authority over every site is exercised, for
example the group security office plus the group steering committee.

### 4.2 Consequences of a nonconformity at one site

Plan for this before the audit. Under the multi-site rules, a
nonconformity found at one site (by your own internal audit or by the
CB) must be analysed to decide whether it reflects a system-wide
weakness. If it does, correct it at the central function and at every
affected site; if it does not, record why the follow-up is limited. A
major nonconformity open at any site at the time of the certification
decision holds back certification of the whole multi-site organization,
and removing the problem site from the scope during the process to
avoid this is not accepted. This is why section 6 makes each new site
pass an internal audit before the CB sees it.

## 5. Site register and sampling groups

<!-- Guidance: List every site, what happens there and whether it performs very similar activities to other sites. Only sites with very similar activities can be grouped for sampling. The CB makes the sampling decision; your job is to give it accurate facts. -->

### 5.1 Site register

| Site ID | Site | Country | Activities in scope | Persons doing work under the organization's control | Very similar to | Proposed treatment |
|---|---|---|---|---|---|---|
| SITE-01 *(Example)* | Quillmere Group HQ (central function) | Country A | Group management, group security office, shared services | [n] | None | Audited at every audit (central function) |
| SITE-02 *(Example)* | Group data centre | Country A | Hosting of ERP, identity, OT historian | [n] | None | Not sampled |
| SITE-03 *(Example)* | Service centre | Country B | Customer support, field service planning | [n] | None | Not sampled |
| SITE-04 *(Example)* | Plant A | Country B | Manufacturing, OT network, warehouse | [n] | SITE-05, SITE-06 | Sampling group PLANTS |
| SITE-05 *(Example)* | Plant B | Country C | Manufacturing, OT network, warehouse | [n] | SITE-04, SITE-06 | Sampling group PLANTS |
| SITE-06 *(Example)* | Plant C | Country D | Manufacturing, OT network, warehouse | [n] | SITE-04, SITE-05 | Sampling group PLANTS |

Quillmere Group has 2,400 staff across these 6 sites in 4 countries.
Fill the headcount column from HR data on the same date for every site,
and make sure the figures add up to the group total you declare on the
CB application form: audit time depends on it.

### 5.2 How sampling usually works (for planning only)

The general multi-site document lets the CB sample sites only where
they perform very similar activities, and requires the CB to have its
own documented rules that restrict sampling where risk or complexity
is high. Its general approach sets a minimum sample from the square root
of the number of sites in a group (rounded up), with a reduced factor
for surveillance, at least a quarter of the sample chosen at random,
and the central function audited at initial certification, every
recertification and at least once each calendar year. Sites that cannot
be sampled are audited in full at initial certification and
recertification and in part during surveillance. ISO/IEC 27006-1:2024
sets ISMS-specific multi-site requirements that take precedence, so
your CB may apply different or additional rules.

| Item | Planning assumption | Confirmed by CB |
|---|---|---|
| Sampling group PLANTS: sites in group | 3 *(Example)* | [Yes / No, date] |
| Sites visited at the extension audit | 2 of 3 *(Example: square root of 3 is 1.73, rounded up to 2)* | [CB figure] |
| Sites visited per surveillance year | 2 of 3 *(Example: 0.6 x 1.73 = 1.04, rounded up to 2)* | [CB figure] |
| Non-sampled sites (HQ, data centre, service centre) | HQ every audit; data centre and service centre on a rotation set by the CB *(Example)* | [CB figure] |
| Remote audit of any site | [Proposed for which activities] | [CB decision] |

Treat these figures as a planning aid for budget and site preparation.
Do not quote them to management as commitments until the CB confirms
them in writing in the audit programme.

## 6. Site readiness checklist

<!-- Guidance: Use one copy per new site or service. A site is ready for the CB only when every mandatory row is Yes with evidence. The internal audit (row R12) is the gate: do not notify the CB that the site is ready before it has closed its major findings. -->

| # | Readiness item | Evidence | Mandatory | Status |
|---|---|---|---|---|
| R01 | Site or service described in the updated scope statement | Scope DOC-ISMS-002 vX.Y | Yes | [Yes / No] |
| R02 | Site security coordinator named and trained | RACI DOC-ISMS-006, training record | Yes | [Yes / No] |
| R03 | Information assets and systems recorded | Asset inventory DOC-ISMS-012 | Yes | [Yes / No] |
| R04 | Risks assessed with the group method and recorded | Risk register DOC-ISMS-016 entries | Yes | [Yes / No] |
| R05 | Treatments planned, owners and dates set | Risk treatment plan DOC-ISMS-013 | Yes | [Yes / No] |
| R06 | SoA revised for site-specific controls | SoA DOC-ISMS-011 new version | Yes | [Yes / No] |
| R07 | Local legal and contractual requirements recorded | Legal register DOC-ISMS-014 | Yes | [Yes / No] |
| R08 | Group policies published at the site, in the local language where needed | Policy acknowledgement report | Yes | [Yes / No] |
| R09 | All staff completed security awareness onboarding | Training completion report | Yes | [Yes / No] |
| R10 | Physical security controls in place (entry, visitors, secure areas) | Physical security policy DOC-ISMS-055, site walk record | Yes | [Yes / No] |
| R11 | Access control, logging and backup cover the site's systems | Access review, log source list, backup report | Yes | [Yes / No] |
| R12 | Internal audit of the site completed, major findings closed | Internal audit report DOC-ISMS-084 | Yes | [Yes / No] |
| R13 | Incident reporting tested from the site | Test ticket or exercise record | Yes | [Yes / No] |
| R14 | Site included in the next management review | Management review agenda or minutes | Yes | [Yes / No] |
| R15 | Business continuity and ICT readiness cover the site | BCP DOC-ISMS-121, ICT readiness plan DOC-ISMS-047 | Where relevant | [Yes / No] |
| R16 | Suppliers specific to the site assessed | Supplier register DOC-ISMS-066 | Where relevant | [Yes / No] |
| R17 | Records have operated long enough to be sampled | [e.g. 2 months of access reviews and incident logs] | Yes | [Yes / No] |

How long the site must operate before the CB visits is not fixed by
ISO/IEC 27001. It is CB practice to expect records that show the
controls working, so plan at least one full cycle of the recurring
controls (access review, backup test, vulnerability scan) at the new
site.

## 7. Notification and engagement with the certification body

<!-- Guidance: The certification agreement obliges you to tell the CB about significant changes without delay. Late notification is a common cause of surprises at surveillance, and in the worst case of suspension. Keep the notification in writing and record the CB's answer. -->

The certification agreement required by ISO/IEC 17021-1 makes the
certified client responsible for informing the CB promptly of matters
that can affect the ISMS's ability to keep meeting the requirements.
In practice this covers changes to legal status, ownership or
commercial standing; organization and top management; contact address
and sites; the scope of activities covered; and major changes to the
ISMS and its processes. Check the exact list in your contract.

### 7.1 Notification log

| ID | Date sent | Change notified | Sent by | CB response | Outcome |
|---|---|---|---|---|---|
| CBN-001 *(Example)* | YYYY-MM-DD | Phase 2: add Plant A, B and C; revised headcount and site list | [@isms-manager] | CB requests updated application form and site details | Extension audit proposed alongside surveillance 1 |
| CBN-002 *(Example)* | YYYY-MM-DD | Acquisition of service subsidiary; integration plan | [@isms-manager] | CB asks for integration status at next surveillance | Entity added after readiness confirmed |
| CBN-003 | YYYY-MM-DD | [Change] | [@owner] | [Response] | [Outcome] |

### 7.2 Information the CB usually asks for

- Updated application form: legal entities, sites with addresses,
  activities per site, persons doing work under the organization's
  control per site, shift patterns, and outsourced processes.
- Proposed scope wording and the revised SoA version.
- Evidence that the central function controls the new sites
  (section 4).
- Readiness status per site (section 6) and the internal audit report.
- Preferred dates, languages spoken at the site and any safety or
  access constraints (for example, OT areas that need escorted access).

### 7.3 How the CB may handle the extension

The CB decides the route, and it may differ from what you propose:

| Route | When it is typically used | Planning impact |
|---|---|---|
| Separate extension audit | Large change, new country, high-risk activities | Extra audit days, separate date |
| Extension combined with a surveillance audit | Change timed close to a planned surveillance | Longer surveillance, one visit |
| Extension at recertification | Change near the end of the cycle | No separate visit; risk of waiting |
| Document review only | Very small change with low risk (CB judgement) | Least effort, CB decides |

Whatever the route, the certificate is amended only after the CB's
certification decision. Do not advertise the extended scope before the
amended certificate is issued (`isms/certification-mark-usage`).

## 8. Plan and timeline

<!-- Guidance: Work back from the date the certificate must show the new scope. Leave a buffer for the CB's scheduling and for closing findings. The Gantt dates below are an Example for Quillmere Group phase 2. -->

```mermaid
flowchart TD
  A["Decision to extend: steering committee"] --> B["Section 2: define new scope and interfaces"]
  B --> C["Section 4: confirm central function and eligibility"]
  C --> D["Section 3: update context, risk, SoA"]
  C --> E["Notify CB and send updated application"]
  D --> F["Section 6: site readiness checklist"]
  E --> F
  F --> G["Internal audit of new sites"]
  G --> H{"Major findings closed?"}
  H -- "No" --> F
  H -- "Yes" --> I["Management review covers extension"]
  I --> J["CB extension audit"]
  J --> K{"CB decision"}
  K -- "Findings to close" --> L["Corrective actions accepted by CB"]
  L --> K
  K -- "Approved" --> M["Amended certificate issued"]
```

```mermaid
gantt
  title Phase 2 extension, Quillmere Group (Example)
  dateFormat YYYY-MM-DD
  section Prepare
  Scope and impact analysis      :p1, 2027-04-05, 21d
  Notify CB and application      :p2, after p1, 7d
  section Sites
  Risk assessment of plants      :s1, after p1, 30d
  SoA and treatment update       :s2, after s1, 14d
  Controls and training at plants :s3, after s2, 45d
  section Check
  Internal audit of plants       :c1, after s3, 14d
  Corrective actions             :c2, after c1, 21d
  Management review              :c3, after c2, 3d
  section Certify
  CB extension audit             :a1, 2027-09-27, 5d
  CB decision and certificate    :a2, after a1, 30d
```

| Milestone | Planned date | Owner | Done |
|---|---|---|---|
| Scope and impact analysis approved | [2027-04-26 *(Example)*] | [@isms-manager] | [ ] |
| CB notified, application updated | [2027-05-03 *(Example)*] | [@isms-manager] | [ ] |
| Site readiness checklist complete (controls and training done) | [2027-07-24 *(Example)*] | [@site-managers] | [ ] |
| Internal audit of new sites and corrective actions closed | [2027-08-28 *(Example)*] | [@internal-audit] | [ ] |
| Management review held | [2027-08-31 *(Example)*] | [@sponsor] | [ ] |
| CB extension audit (date set by the CB; the gap after the review is scheduling buffer) | [2027-09-27 *(Example)*] | [CB] | [ ] |
| Amended certificate | [by 2027-11-01 *(Example)*] | [CB] | [ ] |

### 8.1 Budget

| Item | Estimate (USD, *Example*) |
|---|---|
| CB extension audit days (CB quotation) | [amount] |
| Auditor travel to plants | [amount] |
| Internal audit of three plants | [amount] |
| Site controls (physical access, OT network monitoring) | [amount] |
| Translation of policies and training | [amount] |
| **Total** | [sum of rows above] |

Use local currency where you budget. Feed the total into the budget and
resource plan (`isms/isms-budget-resource-plan`).

## 9. Scope reduction and site removal

<!-- Guidance: Reductions happen after divestments, site closures or a decision to drop a service. They also need CB notification and a revised scope. Pitfall: dropping a site from scope to escape an open nonconformity, which the CB will not accept during an ongoing certification process. -->

| Field | Entry |
|---|---|
| Part leaving the scope | [Site, entity or service] |
| Reason | [Divestment / Closure / Business decision] |
| Effective date | YYYY-MM-DD |
| Interfaces that remain (shared systems, data, staff) | [Describe; these stay in scope or become supplier relationships] |
| Information and assets to return, transfer or dispose of | [Asset list, disposal records DOC-ISMS-057] |
| Access to revoke | [Accounts, VPN, badges] |
| Open risks, findings or incidents at that site | [List and how they will be closed] |
| CB notified | [CBN-NNN, date] |

When a site leaves, check that customer contracts, trust centre pages
and marketing material no longer claim it is certified.

## 10. Size tiers

<!-- Guidance: Show how the plan scales. Small organizations rarely have multi-site issues but do extend scope to new services; large groups need the full multi-site machinery. -->

| Aspect | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large: Quillmere Group (2,400 staff, 6 sites) |
|---|---|---|---|
| Typical extension | Add a newly launched product module or a new production region with the same cloud provider | Bring the managed service and the colocation suite into scope, or add the second office | Phase plants into a group certificate; add an acquired subsidiary |
| Multi-site relevance | Usually none: one office plus remote staff; remote work is covered in the scope, not as sites | Two offices and a colocation suite; CB decides whether sites are sampled or each audited | Full multi-site approach with a central function and sampling groups |
| Plan depth | Sections 1 to 3, 6 and 7 on two pages | All sections; sampling table short | All sections; one readiness checklist per site |
| Who runs it | ISMS manager (0.5 FTE, Head of Engineering Operations) | Full-time ISMS manager with the 3-person security team | CISO's 14-person security office with site coordinators |
| CB route usually seen | Document review or combined with surveillance (CB decides) | Combined with surveillance | Separate extension audit or combined with surveillance, multi-day |
| Main risk | New region configured differently from the primary one | Colocation provider controls not evidenced | OT environments and local language records at plants |

## 11. Records and evidence

<!-- Guidance: These records prove the extension was planned and controlled. Link each to the control evidence matrix (DOC-ISMS-033) so evidence owners are clear for the CB visit. -->

| Record | Proves | Owner | Location | Retention |
|---|---|---|---|---|
| Steering committee decision to extend | Planned change (6.3), top management direction | [@sponsor] | [Minutes repository] | [Certificate cycle + 3 years] |
| This plan, approved | Planned change and scope definition | [@isms-manager] | [Document management system] | [Certificate cycle + 3 years] |
| Revised scope document and SoA versions | Clause 4.3, 6.1.3 d | [@isms-manager] | [Document management system] | [Superseded versions: 3 years] |
| Risk assessment results for new sites | Clause 8.2 | [@risk-owner] | [Risk register tool] | [3 years] |
| Site readiness checklists | Operational readiness (8.1) | [@site-managers] | [ISMS workspace] | [Certificate cycle] |
| Internal audit reports of new sites | Clause 9.2 | [@internal-audit] | [Audit repository] | [Certificate cycle + 3 years] |
| Management review minutes covering the extension | Clause 9.3 | [@sponsor] | [Minutes repository] | [Certificate cycle + 3 years] |
| CB notification log and correspondence | Contractual obligations to the CB met | [@isms-manager] | [CB folder] | [Certificate cycle + 3 years] |
| CB audit report and amended certificate | Certification decision | [@isms-manager] | [CB folder] | [Life of certificate + 3 years] |

Retention periods are examples: set them in the documented information
register (`isms/isms-documented-information-register`) and align with
legal requirements. Map each record to its evidence owner in
`isms/control-evidence-matrix`.

## 12. References

<!-- Guidance: Check editions on the day you use this plan. The accreditation community's mandatory documents moved from IAF to Global ACI in 2026; confirm the current number and version with your CB. -->

| Reference | Edition and status | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | Current (https://www.iso.org/standard/82875.html, Amd 1: https://www.iso.org/standard/88435.html) | Clauses 4.3, 6.3, 8.1 |
| ISO/IEC 17021-1:2015 | Current (https://www.iso.org/standard/61651.html) | Certification process, certification agreement, changes affecting certification |
| ISO/IEC 27006-1:2024 | Current (https://www.iso.org/standard/82908.html) | ISMS-specific audit time and multi-site requirements applied by the CB |
| Global ACI-TECH-3-001 (M), multi-site audit and certification | Version 1.0, issued 2026-07-10, implementation 2026-08-28; based on IAF MD 1:2023 (check the Global ACI document for any changes) (https://global-aci.org/en/global_aci-documents/?cat_id=5) | General multi-site eligibility and sampling |
| Global ACI-TECH-3-002 (M), transfer of accredited certification | Version 1.0, issued 2026-07-10; based on IAF MD 2:2023 | When an acquired entity holds a certificate from another CB |
| Global ACI-TECH-3-003 (M), use of ICT for conformity assessment | Version 1.0, issued 2026-07-10; based on IAF MD 4:2025 | Remote audit of sites |
| Related templates | `compliance/ms-scope`, `isms/isms-change-plan`, `isms/certification-cycle-plan`, `isms/certification-body-selection`, `isms/surveillance-readiness-health-check`, `isms/certification-mark-usage`, `compliance/statement-of-applicability`, `compliance/internal-audit-program`, `compliance/management-review`, `isms/control-evidence-matrix`, `isms/isms-budget-resource-plan` | Linked documents |

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 4.3,
6.3 and 8.1), ISO/IEC 17021-1:2015, ISO/IEC 27006-1:2024 and the
multi-site mandatory document Global ACI-TECH-3-001 (based on IAF MD
1:2023). The text, tables, criteria wording and examples are original;
no ISO, IEC, IAF or Global ACI text is reproduced, and the eligibility
criteria and sampling rules are paraphrased for planning only. Read
the official standards and mandatory documents, and follow your
certification body's procedures, which decide sampling, audit time and
the route of any extension. Check the current editions before use: the accreditation mandatory
documents were renumbered under Global ACI in 2026. Official
ISO text, purchase or licensed access:
https://www.iso.org/standard/82875.html,
https://www.iso.org/standard/61651.html and
https://www.iso.org/standard/82908.html. This is a documentation format,
not certification advice.

Template licence: MIT.