how to do scoping in iso 27001