6.5.1 For r2 assessments, the Scope of the Assessment webform in MyCSF must be completed by the Assessed Entity. For i1 or e1 assessments, the Scope of the Assessment webform in MyCSF can be completed by either the Assessed Entity or External Assessor.
6.5.2 The following information is entered on the Scope of the Assessment webform:
a) Platforms/Systems: The Platforms/Systems table should contain all platforms/systems contained in the scope of the assessment. The description of the platform must include the following:
• The business function of the platform (service offering)
• Relevant technical details around the platform (describing any exclusions)
• A description of any supporting infrastructure
• How the platform is accessed by the Assessed Entity, the Assessed Entity’s customers, and third-parties (if applicable)
b) Facilities: The Facilities table should contain all facilities included in the scope of the assessment. All fields in the Facility table must be completed.
c) Services Outsourced for In-Scope Platforms and Facilities: The Services Outsourced table should contain all organizations that provide services which impact the controls for the in-scope platforms and facilities.
For further details around assessment scoping, see Chapter 7 Scoping the Assessment.