The organization shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcomes of the Information Security Management System (ISMS).
In practice, this means the organization must:
- Identify external issues, such as:
- legal and regulatory requirements
- market conditions
- technological developments
- geopolitical, economic, or societal factors
- Identify internal issues, such as:
- organizational structure and governance
- culture, policies, and objectives
- available resources
- information systems, processes, and capabilities
Internal Issues
These are factors within your organization that influence how you manage information security.
Examples:
| Category | Examples |
| Organizational structure | Hierarchy, roles, decision-making processes |
| Resources | Skilled staff, budget for security, available technology |
| Processes & policies | Existing security procedures, quality management, IT governance |
| Capabilities | Level of cybersecurity expertise, maturity of security culture |
| Culture & values | Attitude toward compliance, employee awareness, risk tolerance |
| Technology | Infrastructure in place, security tools, in-house development systems |
| Contracts & commitments | Internal SLAs, agreements between departments |
| Knowledge & intellectual property | Proprietary data, trade secrets |
External Issues
These are factors outside your organization that can impact your ISMS.
Examples:
| Category | Examples |
| Legal & regulatory | Data protection laws (e.g., GDPR), industry-specific regulations |
| Market & industry trends | New threats, competitor practices, customer expectations |
| Technology changes | Emerging cyber threats, new IT solutions, obsolescence risks |
| Economic factors | Budget constraints due to economic downturns |
| Political factors | Government stability, cybersecurity policies, sanctions |
| Social & cultural factors | Public perception of privacy, social engineering risks |
| Suppliers & partners | Third-party security practices, outsourcing risks |
| Natural environment | Disaster risks (floods, earthquakes) that affect data centers |
These issues must be understood, documented (to an appropriate extent), and kept under review, because they form the foundation for:
- ISMS scope (Clause 4.3),
- Risk assessment (Clause 6.1) and
- Security objectives and controls.
