Staff, contractors and roles in scope.

Business activities and procedures.

Systems, devices and networks.

Data and assets being protected.

Sites and premises covered.