What it asks for. The organisation must understand the internal and external issues relevant to its purpose, identify interested parties and their requirements, decide which of those requirements the management system will address, and define the scope of the information security management system.
In practice. Leadership and the security function document the business context, such as regulatory obligations like NIS2 or DORA, customer expectations, technology dependencies and organisational structure. Interested parties are listed with their relevant requirements. The scope statement is precise about locations, business units, systems and interfaces with things outside the scope, and the management system is established and maintained in line with the standard. Evidence includes the context analysis, interested parties register and a documented scope.
Common gaps. Scopes are often drawn too narrowly to ease certification and do not match what customers believe is covered. Context analyses are written once for the initial audit and never updated as the business changes.