Scope after acquisition: can the SaaS product be declared in scope?
A 600-person managed service provider, Northwind IT, acquired a 90-person analytics firm six months ago. Northwind's SMS scope statement says: “All IT services provided to external customers worldwide.” The analytics firm delivers a SaaS product to 12,000 subscribers using a third-party cloud provider, and its staff also receive internal IT support from Northwind. The acquisition team wants the SaaS product included immediately because “it is an IT service.” The service manager notes that the cloud provider operates the infrastructure under a separate agreement; Northwind manages only the application layer and customer onboarding. No interface agreement exists, and the SaaS team has never been audited against the SMS. Customers now ask for one service catalogue entry and one SLA covering both the SaaS product and Northwind's help desk. The certification body has scheduled a surveillance audit in eight weeks and will ask how scope was determined.
1. Evaluate whether Northwind can simply declare the SaaS product in scope. What does ISO/IEC 20000-1 require when determining scope, and what evidence should the service manager gather before a decision?
Read the worked answer
Scope is not a marketing statement; it must be a documented boundary that identifies the services covered and states which requirements apply, including interfaces to external providers. Northwind cannot simply declare the SaaS product in scope because another organization operates the infrastructure. The service manager should gather the contract and responsibility matrix, the service catalogue, the external provider's certification or controls, customer expectations, risk assessment, and evidence that Northwind can meet the applicable requirements end to end. If the cloud provider is a critical external provider, Northwind needs an interface agreement and defined responsibilities. A defensible decision may be to include the application layer with explicit dependencies, or to exclude the SaaS product until controls exist. The reasoning must be recorded, not just the conclusion.
2. The acquisition team proposes that the CEO sign a revised scope statement and publish it the same day. What leadership and documented-information considerations apply?
Read the worked answer
Top management must ensure the scope is available as documented information, but a signature is not evidence that the scope is achievable. Leadership must show commitment by ensuring resources, assigning roles and authorities, integrating the SMS with business processes, and communicating the scope to interested parties. The revised statement should identify the services and boundaries, explain exclusions and dependencies, and be consistent with the service catalogue and SLAs. Publishing the same day risks creating a commitment that operations cannot meet and that customers will rely on. The service manager should require a documented decision, approval by those accountable for the SaaS service, and a plan for any gaps before publication. Document control, review and communication are part of the requirement, not paperwork.