BritiAI · NHS SBS Bid Vault

NHS SBS Bid Vault SBS10523 · Healthcare AI Solutions

Deadline Tue 21 Jul 2026, 12:00 BST · Content complete Fri 10 Jul → internal review & audit → final submission Tue 14 Jul 2026 · Last updated 2 Jul 2026, 20:00
Time left
--days
:
--hrs
:
--min
:
--sec

33.01 ISMS Scope

7 min read

DRAFT — REQUIRES REVIEW BY EXTERNAL ISO 27001 CONSULTANT AND SIGN-OFF BY BRITIAI CTO BEFORE USE IN BID OR AUDIT.

ISO/IEC 27001:2022 — Information Security Management System Scope Statement

Document ID: ISO01 Version: 0.1 (Draft) Date: 15 June 2026 Owner: BritiAI CISO (interim: CTO) Classification: Internal — Confidential Standard reference: ISO/IEC 27001:2022 Clause 4.3 — Determining the scope of the information security management system

1. Purpose

This document defines the boundaries and applicability of BritiAI Limited’s Information Security Management System (“the ISMS”) in accordance with Clause 4.3 of ISO/IEC 27001:2022. It establishes the organisational, functional, geographic, technological, and informational boundaries of the ISMS, identifies relevant interested parties and their requirements, and records justified exclusions. This scope statement is the controlling reference for the Statement of Applicability (ISO02), the Risk Register (ISO04), and all downstream policies in the ISMS policy framework (ISO05).

2. Organisation in scope

The certified entity is:

BritiAI Limited — a private limited company incorporated in England and Wales, with its registered office and principal place of business in the United Kingdom. BritiAI Limited designs, develops, deploys, and operates artificial intelligence software products and managed services for UK public-sector customers, including the National Health Service.

The ISMS covers all BritiAI Limited employees, contractors, directors, officers, and assigned personnel performing work under the control of BritiAI Limited, regardless of physical location, where their work involves processing information assets owned or controlled by BritiAI Limited or its customers.

3. Organisational boundary — group structure

BritiAI Limited is part of a wider corporate group. For the avoidance of doubt and to provide a defensible certification scope, the following entities are treated as separate legal entities and external sub-processors to BritiAI Limited and are outside the ISMS scope:

  • Votee Limited — a Hong Kong-incorporated company. Provides AI research, model development support, and technical services to BritiAI under a written inter-company services agreement.
  • Beever — Toronto, Canada-based operating unit under Votee Limited. Provides software engineering and creative services on a sub-contracted basis.

Sub-processor treatment. Votee (HK) and Beever (Toronto) are formally treated as third-party sub-processors of BritiAI Limited. Their inclusion in any BritiAI service offering is governed by:

  1. Written sub-processor agreements incorporating UK GDPR Article 28 controller-processor clauses, International Data Transfer Agreements (IDTA) or UK Addendum to the EU SCCs where personal data crosses borders, and confidentiality undertakings.
  2. Flow-down of BritiAI’s information security obligations via contractual schedules aligned to ISO/IEC 27001:2022 Annex A.5.19–A.5.23 (supplier relationships) and A.5.34 (privacy and PII protection).
  3. A documented Supplier Security Assessment (see ISO05 §Supplier Security Policy) executed before onboarding and on annual review.
  4. NHS data segregation control: Votee and Beever personnel and infrastructure are contractually and technically prohibited from processing, accessing, or storing NHS data, NHS-derived data, or any data classified as Patient-Identifiable, Special Category under UK GDPR Article 9, or otherwise subject to the NHS Data Security and Protection Toolkit (DSPT). NHS workloads are restricted to BritiAI-controlled UK infrastructure (see §6).

This separation is enforced through (a) network segmentation and tenant isolation in the cloud platform, (b) role-based access controls that do not provision Votee/Beever identities into NHS-bearing environments, and (c) audit logging that allows BritiAI to demonstrate the absence of cross-entity access during Stage 2 evidence sampling.

4. Functions and services in scope

The following BritiAI business functions and services are within the ISMS scope:

  • Product engineering and software development for BritiAI AI services delivered to UK customers.
  • Machine learning operations (MLOps): training, fine-tuning, evaluation, deployment, and lifecycle management of AI/ML models used in customer-facing services.
  • Cloud platform operations: provisioning, configuration, monitoring, patching, and incident response for production and pre-production environments.
  • Customer onboarding, support, and service management for UK NHS and other UK public-sector customers.
  • Information security operations: identity and access management, vulnerability management, security monitoring, and incident response.
  • Corporate functions executed in the UK: HR (for UK-employed personnel), finance, legal, procurement, and supplier management to the extent they handle information assets within scope.
  • Governance, risk, and compliance activities including the ISMS itself, internal audit, management review, and regulatory engagement.

5. Functions and services excluded from scope (with justification)

  • Votee Limited (HK) and Beever (Toronto) internal operations. Justification: separate legal entities operating under independent management, separate jurisdictions, and not party to NHS data processing. They are addressed as suppliers under A.5.19–A.5.23 rather than as ISMS constituents.
  • Non-UK customer engagements operated solely by Votee or Beever. Justification: outside BritiAI Ltd’s direct operational control.
  • Personal devices not enrolled in BritiAI mobile device management (MDM). Justification: BritiAI enforces a managed-device-only policy for in-scope information processing; personal devices are excluded by policy, not by absence of control.

All exclusions are justified on the basis that they do not undermine BritiAI’s ability to satisfy its information security obligations to NHS and other UK customers, and the boundary controls (segregation, contractual flow-down, monitoring) are themselves within scope.

6. Locations in scope

  • BritiAI registered office and UK operational locations, including remote-working locations of UK-based personnel operating under BritiAI’s remote-working and acceptable use policies.
  • UK-region cloud infrastructure used for production and pre-production workloads. NHS workloads are restricted to UK sovereign regions of the contracted hyperscale cloud provider (e.g. AWS eu-west-2, Azure UK South/UK West, GCP europe-west2), with data residency enforced through tenancy configuration, encryption key location, and policy-as-code guardrails.

Locations explicitly out of scope: Votee offices and infrastructure in Hong Kong; Beever offices and infrastructure in Toronto, Canada; any non-UK cloud regions for NHS workloads.

7. Information assets and types in scope

The ISMS protects the confidentiality, integrity, and availability of:

  • BritiAI source code, model weights, training datasets, evaluation datasets, and associated MLOps artefacts.
  • Customer data processed under contract, including (future state) NHS data subject to the NHS DSPT and UK GDPR.
  • Authentication credentials, cryptographic key material, and secrets.
  • Corporate information: HR records of UK personnel, financial records, contracts, board materials, and intellectual property.
  • Operational telemetry, logs, and security monitoring data.
  • Documentation including this ISMS and its supporting evidence.

Information is classified per the Information Classification Policy (ISO05) into Public, Internal, Confidential, and Restricted tiers, with NHS Patient-Identifiable Data treated as Restricted.

8. Technologies in scope

  • Hyperscale public cloud services (UK regions) — IaaS, PaaS, and managed AI services.
  • BritiAI-developed application code, container images, infrastructure-as-code (Terraform/equivalent), and CI/CD pipelines.
  • Identity provider (single sign-on), MDM, endpoint detection and response, SIEM, and vulnerability management tooling.
  • Productivity and collaboration suite for UK personnel (Microsoft 365 / Google Workspace tenants under BritiAI control).
  • Third-party AI model APIs where used as components of BritiAI services, governed by supplier security assessment.

9. Interested parties and their requirements (Clause 4.2)

  • NHS England, NHS SBS, NHS Trusts — require evidence of ISO 27001 certification (or credible roadmap), DSPT compliance, UK data residency, and adherence to the NHS Healthcare AI Solutions Framework SBS10523 obligations.
  • Information Commissioner’s Office (ICO) — UK GDPR and Data Protection Act 2018 compliance.
  • Customers and end-users — confidentiality, integrity, and availability of services.
  • BritiAI employees and contractors — protection of personal data and a safe working environment.
  • Shareholders and the Board — protection of corporate value and reputational integrity.
  • Suppliers and sub-processors (Votee, Beever, cloud providers, SaaS vendors) — clear flow-down obligations and predictable assurance cycles.
  • Insurers and certification bodies — auditable evidence of ISMS operation.

10. ISMS interfaces and dependencies

The ISMS interfaces with: the BritiAI Data Protection programme (UK GDPR), the BritiAI AI Management System (intended ISO/IEC 42001 alignment), the Business Continuity programme, and customer-imposed security frameworks (notably NHS DSPT and Cyber Essentials Plus).

11. Review and maintenance

This scope statement is reviewed at least annually, on material change to the organisation (acquisitions, divestments, new jurisdictions), on award or loss of NHS contracts, and following any nonconformity raised during certification audit. Changes are approved by the CTO and ratified at the next ISMS Management Review.

End of document.

Graph View

Backlinks