Assessment scope is the defined set of systems, controls, processes, and operating practices that a security review actually examines. In a certification, audit, or assurance exercise, scope answers a basic question: what was tested, and what was not? A narrow scope may cover only one product version, one deployment model, or a limited set of administrative controls.
Scope matters because security claims are only valid within the boundaries that were reviewed. Attackers often exploit the gap between a compliant component and the wider environment around it, such as weak identity controls, unreviewed integrations, or unmanaged updates. Defenders use scope to set expectations, compare evidence fairly, and avoid overclaiming assurance. When a report or assessment does not clearly state scope, the result can be misleading even if the technical findings are sound.