SOC 2 and ISO 27001 Scope

This document explains what "scope" means in the context of SOC 2 and ISO 27001 compliance. It defines the four categories subject to scoping (personnel, infrastructure, code, and physical offices), lists the four types of customer data to consider, and provides concrete examples of in-scope and out-of-scope systems.