Scoping

Scoping is a yes or no call. Starting from a control baseline such as NIST SP 800-53, scoping asks of each control: does this even apply to our environment? If the organisation runs no mainframes, the mainframe-specific controls are scoped out. Nothing is being adjusted or weakened; the control is simply irrelevant because the thing it protects is not present.

The pairing to master is scoping versus tailoring. Scoping decides whether a control applies; tailoring decides how the controls that do apply are implemented. Scoping happens first and is purely about environmental applicability, not risk ranking and not documentation of strength. The distinction, and why the exam treats it as a clean either-or, is worked in the scoping versus tailoring insight.

Exam relevance: the trap is to blur scoping into tailoring. Fix the verbs: scoping removes controls that do not apply (whether), tailoring adjusts controls that do (how). “We have no wireless network, so we omit the wireless controls” is scoping. If the scenario changes a parameter of a control that still applies, that is tailoring instead.