The process of defining the characteristics and related controls that must be in place to ensure that an outsourcer can achieve and maintain an acceptable level of residual risk. An outsourcer uses scoping to configure a third party assessment based upon the risk the specific outsourced service presents to the organization. When scoping for an assessment, the process should be applied to yield the clearest possible understanding of the risk associated with a specific outsourced service.
