Entity has a documented ISMS scope that defines which information and information assets the organisation intends to protect