Skip to content

Clause 4.1 of ISO/IEC 27001:2022, Understanding the organisation and its context

Before you can run an ISMS, you have to know what world it is operating in.

Clause 4.1 asks for one thing: a short, written picture of what affects your information security, outside the organisation and inside it.

  • Outside. Things you do not control. Law, customers, technology, weather, competitors.
  • Inside. Things you do control. Culture, governance, skills, systems, past audits.
  • The output. One or two pages. Dated. Named. Read in five minutes.
  • The point. It feeds the scope, the risk assessment, and the management review.
The context picture, and the four things that make it A concept map of clause 4.1. At the centre is the context picture: a short, dated statement of the things that affect information security. Four peers hang off it, in no particular order. Looking outward covers external issues the organisation does not control: social, political, legal, financial, technological, natural and competitive. Looking inward covers internal issues it does control: culture, governance, capabilities, infrastructure, information systems, contracts and previous audits. What it feeds names the downstream clauses that consume the picture: 4.3 scope, 6.1 risks and opportunities, and 9.3 management review. Keeping it current covers review at planned intervals, because issues change. The four are peers, not steps, and the map draws no arrows between them. The context picture Clause 4.1. One or two pages, dated and named. Short enough to read in five minutes. Look outward 4.1 a. External issues you do not control: social, political, legal, financial, natural. Look inward 4.1 b. Internal issues you do control: culture, governance, capabilities, past audits. What it feeds 4.1 c. Feeds the scope in 4.3, risks in 6.1, and the 9.3 review agenda. Keeping it current 4.1 c. Reviewed at planned intervals, and whenever something big changes. The context picture, and the four things that make it A concept map of clause 4.1. At the centre is the context picture: a short, dated statement of the things that affect information security. Four peers hang off it, in no particular order. Looking outward covers external issues the organisation does not control: social, political, legal, financial, technological, natural and competitive. Looking inward covers internal issues it does control: culture, governance, capabilities, infrastructure, information systems, contracts and previous audits. What it feeds names the downstream clauses that consume the picture: 4.3 scope, 6.1 risks and opportunities, and 9.3 management review. Keeping it current covers review at planned intervals, because issues change. The four are peers, not steps, and the map draws no arrows between them. The context picture Clause 4.1. One or two pages, dated and named. Short enough to read in five minutes. Look outward 4.1 a. External issues you do not control: social, political, legal, financial, natural. Look inward 4.1 b. Internal issues you do control: culture, governance, capabilities, past audits. What it feeds 4.1 c. Feeds the scope in 4.3, risks in 6.1, and the 9.3 review agenda. Keeping it current 4.1 c. Reviewed at planned intervals, and whenever something big changes.

The four are peers, not steps. Look outward and inward in either order, or in the same workshop.

Amendment 1:2024 changes this clause

ISO/IEC 27001:2022/Amd 1:2024, "Climate action changes", published February 2024, amends clause 4.1. It is one page and free from ISO. If your context analysis predates it, it is out of date.

Read it before you finalise anything: ISO/IEC 27001:2022/Amd 1:2024. I have confirmed the amendment exists, is free, and applies to this clause. I have not read its text, so take the wording from ISO rather than from me.

External issues: what to actually look at

Category Look at
Social and cultural Public attitudes to data, expectations of privacy, how people actually use your systems
Political, legal, regulatory The laws that apply, the regulators who watch your sector, changes coming
Financial and macroeconomic Interest rates, exchange rates, the cost of cyber insurance
Technological New tools, new attack techniques, end of life on a platform you depend on
Natural Weather, flood, fire, earthquake, whatever your locations are exposed to
Competitive What peers are doing, what threat actors target in your sector

Internal issues: what to actually look at

Category Look at
Culture How people behave when nobody is watching. Security as habit or as hurdle
Policies and strategies The other rules the organisation already lives by. The ISMS has to fit
Governance and roles Who decides. Who is accountable. The org chart in plain words
Other management systems Any quality, environmental or service management system already running
Contractual relationships Key suppliers, outsourcers, partners. What they owe you and you owe them
Processes and procedures The day to day work. How information actually moves
Capabilities People, money, time, knowledge. What you can do with what you have
Physical infrastructure Offices, data centres, secure rooms, home working
Information systems and flows The systems holding the data, and the path data takes between them
Previous audits and assessments Last year's findings. Risks you already know about. Do not start from zero

You do not need every row. You need the ones that actually affect you.

How to do it

  1. Pick three to five people. CISO, head of ops, head of IT, a commercial or finance lead. Different angles on the same organisation.
  2. Run one workshop. Two hours. Walk the external list, then the internal list. Write down what matters. Do not try to solve anything.
  3. Write it down short. One or two pages. Plain words. The date and who was in the room.
  4. Point it at something. 4.3 scope, 6.1 risks, 9.3 review agenda.
  5. Review it. At least yearly, and whenever something big changes.

What good looks like

  • One or two pages, readable in five minutes.
  • Written in the words the business uses, not standards language.
  • Dated, versioned, reviewers named.
  • Referenced from the scope statement, the risk methodology and the review template.
  • Reviewed on a schedule, and the review recorded.

Common pitfalls

  • A twenty-page essay. It will not be read and will not be updated.
  • Standards-speak. "Regulatory pressure on data residency" is not actionable. "The EU has new rules on where customer data can sit" is.
  • Issues that lead nowhere. If the picture does not visibly shape the scope or the risk register, it is decoration.
  • Never reviewed. A context document from two years ago describes a different world.

Documents this clause should produce

Document For Mandatory? Format
Context analysis The picture of external and internal issues Yes (7.5.1 b: the organisation decides what documented information it needs) One or two pages, dated, signed by participants
Context review log Evidence it is reviewed at planned intervals Recommended A short table, one row per review
Issues to scope and risk links Shows how each issue shapes scope or risk Recommended A small table, or a section in the analysis
Stakeholder list (feeds 4.2) Working list of who you deal with Recommended A spreadsheet, kept current

Linked documents

Document How it depends on 4.1
ISMS scope statement (4.3) The scope is drawn around the issues that matter
Risk methodology and criteria (6.1.2) The risk picture is built from the issues
Information security objectives (6.2) Objectives respond to the most material issues
Management review agenda (9.3) Review of context is the first item

Key definitions

Term Meaning here
External issues Outside the organisation. Laws, customers, technology, weather, competitors
Internal issues Inside it. Culture, governance, skills, systems, processes, audits
Context The two together
Planned intervals A cadence you set. The standard does not name one. Most organisations pick yearly

Primary sources

Verify before you rely on it

A working interpretation of ISO/IEC 27001:2022 clause 4.1, written for practitioners. The standard is the only authoritative source. Check the current text before relying on any wording in an audit or filing.

Part of Clause 4, Context of the organisation, which shows how 4.1 depends on the other three. The working files are in the implementation kit.