Meryam Sahin (talk | contribs) No edit summary |
Meryam Sahin (talk | contribs) No edit summary |
||
| Line 1: | Line 1: | ||
__NOTOC__ | __NOTOC__{{Textbox|boxtype=note|header=About this chapter|text=This chapter requires organizations to understand their environment and define the scope of the ISMS. It contains four sub-clauses.|icon=no}} | ||
This chapter requires organizations to understand their environment and define the scope of the ISMS. It contains four sub-clauses | |||
===== 4.1 Understanding the organization and its context ===== | ===== 4.1 Understanding the organization and its context ===== | ||
Latest revision as of 14:26, 22 June 2026
About this chapterThis chapter requires organizations to understand their environment and define the scope of the ISMS. It contains four sub-clauses.
4.1 Understanding the organization and its context
- The organization must determine external and internal issues that are relevant to its purpose and affect its ability to achieve the intended outcomes of the ISMS.
- This could include regulatory requirements, market conditions, contractual obligations, cultural factors, and technological changes.
4.2 Understanding the needs and expectations of interested parties
- Identify stakeholders (customers, regulators, suppliers, employees, etc.) that are relevant to the ISMS.
- Determine their requirements regarding information security.
4.3 Determining the scope of the ISMS
- Define the boundaries and applicability of the ISMS.
- Consider external/internal issues, interested parties, and interfaces/dependencies with other organizations.
- The scope must be documented. (MANDATORY!)
4.4 Information security management system
- The organization must establish, implement, maintain, and continually improve the ISMS according to the requirements of ISO/IEC 27001.
