Scope assessment for security duties: what the decision maker looks at
A scope assessment for security duties sets the boundary of an organisation's obligations before any remediation work begins. The decision maker checks which systems, data flows and third parties actually fall inside that boundary, who already processes what, and which existing contracts or regulators have a prior claim on the same ground. The output is a defined perimeter, not a fix.
Why this stage exists
Security obligations attach to systems and data, not to departments. Without a scope assessment, remediation work often starts on the wrong asset list, and the organisation discovers gaps only after a deadline has already passed. The assessment fixes the perimeter first, so that every later step — gap review, remediation, sign-off — works from the same map.
The practical effect is timing. A clear scope shortens the review that follows it. An unclear scope multiplies meetings without moving the risk position.
What the decision maker checks
| Check | What it establishes | Typical evidence |
|---|---|---|
| Asset inventory | Which systems and data sets exist and who owns each one | Register, asset list, system diagram |
| Data flow mapping | Where data moves between internal teams and external parties | Flow charts, vendor list, contract schedule |
| Third-party exposure | Which vendors, processors or platforms sit inside the perimeter | Processing agreements, service descriptions |
| Existing obligations | Which duties already apply through prior contracts or approvals | Signed agreements, internal sign-offs |
| Trigger events | Whether a change, incident or new product has moved the boundary | Change log, incident record, product brief |
Steps to run the assessment
- The compliance owner pulls the current asset inventory and flags anything added or removed since the last review.
- The technical lead maps data flows across each asset and marks every point where a third party touches the data.
- The compliance owner cross-checks the map against existing contracts to identify obligations that already apply.
- The decision maker drafts a scope statement naming what sits inside the perimeter and what sits outside it.
- The scope statement goes to the relevant internal approver for sign-off before remediation planning starts.
- The approved scope is logged with a review date, so the next assessment starts from a known baseline.
Who decides and how long it takes
The scope statement is normally approved by the person or committee holding compliance ownership inside the organisation — a data protection lead, a security officer, or a small internal committee, depending on size. Where the outcome affects a regulator-facing filing, the relevant supervisory function reviews the statement before it is used externally.
A single-entity assessment with a stable asset list usually closes within one to two working weeks. An assessment covering several entities, active vendor negotiations, or a recent incident runs longer, because each additional trigger reopens part of the map.
Common forks
- If a vendor agreement inside the perimeter is close to expiry, timing should align with the contract cycle rather than run separately — see Renewal and price review: stages and deadlines.
- If the assessment runs alongside a corporate reorganisation, ownership of the affected rights can shift with the entity structure — see How group restructuring of rights IP licence runs in.
- If the organisation is preparing to list a token or digital asset alongside the security review, the two exercises share much of the same evidence base — see Listing preparation step by step in detail.
- If the scope statement is disputed, internally or by a regulator, the clock for any appeal starts from the date of notification — see When the deadline for appeal has started: the deadline.
What this page does not cover
This page describes how the boundary is set and who signs it off. It does not list which specific duties apply once the boundary is drawn, and it does not fix a duration in advance — both depend on the asset count and the number of jurisdictions involved. It also does not cover remediation itself, which starts once the scope is approved.
Related publications
Once scope is fixed, the next step is usually a structured gap review — see How gap review and remediation plan data protection what.
Verified
This description reflects the procedure as we apply it in current matters. It is reviewed each time our internal practice changes, without relying on a fixed external source list.
FAQ
How long does scope assessment for security duties take in practice?
A single-entity review with a stable asset list typically takes one to two working weeks. Multiple entities, recent incidents, or active vendor changes extend that window.
Which documents are needed to start?
The asset inventory, current data flow map, and the existing contracts covering any third party inside the likely perimeter. Without these three, the assessment cannot begin.
What happens if the other side does not respond?
Where the scope depends on a third party's confirmation and no response arrives, the decision maker records the asset as unresolved and sets a follow-up date rather than guessing its status.