Control 4.1Understanding the organization and its context
The starting point of the whole management system: work out what the organisation is, what it is trying to achieve, and which internal and external issues bear on its ability to achieve the intended outcomes of an information security management system.
External issues are the ones a security function tends to list readily — regulation, the threat landscape, the market, technology. Internal ones are less comfortable and more decisive: the business model, the structure, the culture, contractual commitments, how decisions actually get made.
The output is not a document for its own sake. Everything downstream depends on it — the interested parties in 4.2, the scope in 4.3, the risks in 6.1. An ISMS built on a context section copied from a template produces a risk assessment about somebody else’s organisation, and that is the failure mode auditors see most: context written once, never revisited, and contradicted by the risk register beside it.
How to put this in place
An ISMS that ignores what is happening around the organisation protects the wrong things. At the start you record the internal and external issues that shape it, including whether climate change is a relevant issue, which the 2024 amendment asks you to decide.
- List internal and external issues, such as regulation, customers, technology, suppliers and structure, with input from leaders.
- Decide whether climate change is a relevant issue for the ISMS, and record the decision either way.
- Write the result in a short context record with an owner.
- Use it as an input to scope, risk assessment and objectives.
- Review it at planned intervals and in the management review.
Evidence an auditor usually looks for: a dated context record, including the climate change decision, that top management has seen, and evidence it is reviewed.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 1 (Decide and scope) of the implementation plan, which sets out the work and the gate that closes the phase.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.