Key takeaways
- Identify internal and external issues that affect your ability to protect information — e.g. market, regulation, technology, culture, climate considerations.
- Your ISMS must fit your organisation.
- Start here: hold a short workshop with leaders to list internal issues (culture, capability, systems) and external ones (market, law, threats, climate).
Purpose
Identify internal and external issues that affect your ability to protect information — e.g. market, regulation, technology, culture, climate considerations.
Requirement
Requirement summaryThe organization shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s) of its information security management system.
Why it matters
Your ISMS must fit your organisation. Understanding context ensures risks and controls reflect your real situation, not a generic template.
How to implement
- Hold a short workshop with leaders to list internal issues (culture, capability, systems) and external ones (market, law, threats, climate).
- Capture issues in a context document using a simple method such as SWOT or PESTLE.
- Explain how each issue affects information security outcomes.
- Review the issues at management review and when the business changes.
What evidence you need to provide
Here is what you will typically need to provide for Clause 4.1. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- A short document listing the internal and external issues that affect your security (for example growth plans, remote working, regulations, threats).
Records and examples to show
- Notes from the meeting where these issues were discussed and agreed.
- Proof the list is reviewed at least once a year, such as a review date or management review minutes.
Things you should be able to show or explain
- Management should be able to explain the main issues and how they shaped your security programme.
How much to show: The current list and the last review.
Common mistakes
- A generic list that could apply to any company.
- Issues never updated.
- A generic list that could describe any company.
- Issues that never feed into risk assessment.
- Tip: Keep your scope tight for your first certification — you can always expand it later.
Policies & documents to have
- ISMS scope statement
FAQ
Can we exclude clause 4.1?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
A considered list of issues that clearly feeds into risk assessment.