# Scope Stage — Elaboration

## Criteria Guidance

### Good criteria — concrete and verifiable

- "Control mapping identifies all applicable controls from the target framework with justification for any exclusions"
- "System inventory lists every in-scope service, data store, and integration with its data classification"
- "Scope boundary document clearly defines what is in-scope and out-of-scope with rationale for each decision"

### Bad criteria — vague (no clear check)

- "Scope is defined"
- "Controls are mapped"
- "Systems are inventoried"

