OBL-02Obligations and Compliance
Scope decided and documented
What is in scope for each framework or certification is decided, justified and recorded, including deliberate exclusions.
Why it exists
Undecided scope expands until the team drowns.
What usually proves it
Scope statement, exclusion justifications, reopening triggers.
Smaller organizations
One product, one cloud, written down in a page.
Mapped to
- Fully addressedSOC 2 Trust Services Criteria · CC1.5
- Fully addressedISO/IEC 27001 Annex A · 4.3
- Fully addressedNIST Cybersecurity Framework · GV.OC-04
- Fully addressedPCI DSS · 12.5.2
- Partially addressedHIPAA Security Rule · 164.306(a) — Scope follows ePHI wherever it exists.
- Partially addressedGDPR · Art. 3 — Territorial scope is set by law, not chosen.
- Partially addressedEU AI Act · Art. 6 — Scope follows the risk classification of the system.
- Fully addressedNIST AI Risk Management Framework · MAP 1.1