Certification Scope Boundary
The declared set of systems, locations and people a certification covers, which determines both its cost and what it actually tells a customer.
A certification applies to a defined scope, and the scope is chosen by the organisation being certified. That fact is under-appreciated in both directions.
For the certifying organisation, scope is the main cost lever. Every system inside must meet the full control set and be evidenced; every system outside must be demonstrably unable to affect what is inside, which requires real segregation rather than an assertion. Narrowing scope to the systems that genuinely process customer data — and architecting for that separation — is the difference between a manageable programme and an estate-wide one.
For a customer reading the certificate, the scope statement is the most important part and the least read. A certification covering one product line and one data centre says nothing about the service being purchased if that service sits outside it.
The architectural consequence is that segregation becomes a design requirement justified by audit cost rather than only by security: separate accounts or subscriptions, network isolation, distinct identity boundaries and separate pipelines, arranged so the boundary is demonstrable to an assessor. Retrofitting that separation is a common and avoidable cost of a first certification.