https://www.pivotpointsecurity.com/iso-27001-scope-definition/