4 Context of the organization

This clause requires organizations to understand their environment and define the scope of the ISMS. It contains four sub-clauses:

4.1 Understanding the organization and its context

• The organization must determine external and internal issues that are relevant to its purpose and affect its ability to achieve the intended outcomes of the ISMS.
• This could include regulatory requirements, market conditions, contractual obligations, cultural factors, and technological changes.

4.2 Understanding the needs and expectations of interested parties

• Identify stakeholders (customers, regulators, suppliers, employees, etc.) that are relevant to the ISMS.
• Determine their requirements regarding information security.

4.3 Determining the scope of the ISMS

• Define the boundaries and applicability of the ISMS.
• Consider external/internal issues, interested parties, and interfaces/dependencies with other organizations.
• The scope must be documented. (MANDATORY!)

4.4 Information security management system

• The organization must establish, implement, maintain, and continually improve the ISMS according to the requirements of ISO/IEC 27001.