Define your NIST 800-171 Audit Scope

Overview

Define your NIST 800-171 Audit Scope to set the boundaries of the audit and identify the object in focus.

The object includes the people, data, system, or product in review. The scope definition allows the auditors to focus on an aspect of the organization. It is important to clearly define the scope of review for your given audit.

Determining your NIST 800-171 audit scope requires your organization to specify the product, the data, the systems, and the vendors in scope.

Read below for guidance on how to determine each scope item. A table listing each item is provided below to use as a template for this exercise.

Product(s) in scope

For a Software as a Service (SaaS) provider, the scope is typically the software application(s) offered to clients. Some organizations have multiple products,and it is important to define for your NIST 800-171 what product is in focus and what product isn’t.

Data in scope

In order to identify the data in scope, the ideal step is to focus on the type of data and people that flow through the product or service identified. For a SaaS provider, it’s typically all the data held in it (i.e., customer data, etc.) and the people that support it, such as vendors and employees.

Systems in scope

Take an inventory of all the various systems and internal controls that are critical to delivering your service or product within scope. This includes email and Slack. The key is to focus on the systems and tools that are essential to delivering your service / product. Production systems have a direct impact on your product or service in lieu of non-production systems.

For HR systems, focus on systems that manage employee onboarding and training processes. Everything else, such as time off requests and benefits, is out of scope since it is not critical to delivering a service or product.

For a SaaS provider, it’s typically all the infrastructure that hosts it and the procedures that support it, such as AWS, Github, JIRA, etc.

Vendors in scope

In order to identify the vendors in scope, focus on the critical vendors, such as cloud hosting and production related organizations used to support the product or service in scope.

Scoping guidance template

Scoping guidance

Provide a detailed description of your organization’s products or services. Focus on the product or service under review.

Provide the type of data and people that flow through the product or service under review.

Please provide a list of systems / tools that flow through or support the product or service under review.

Please provide a list of critical vendors being used to support the product or service under review.

To learn more about how TrustCloud can help you with NIST 800-171 compliance, click here.