Review readiness for an information security management system built around risk management, governance, controls, audit, and continual improvement.

Has the ISMS scope been documented with boundaries, locations, assets, technologies, and interested parties?

The scope should explain what is included, what is excluded, and why exclusions are justified.