An ISMS can apply to an entire company. However, you can also adapt the scope for your ISMS to the specific needs and requirements of your company. For example, the scope may include a (SaaS) product, specific processes, specific locations, or business units. The scope should be regularly monitored and updated to ensure that it is still relevant and consistent.