Understanding the organization and its context
The organization has to identify the internal and external issues that bear on its purpose and that influence whether its ISMS can deliver the outcomes intended for it.
What the requirement asks
The organization has to identify the internal and external issues that bear on its purpose and that influence whether its ISMS can deliver the outcomes intended for it. The note links this to establishing external and internal context in ISO 31000:2018, 5.4.1. Amendment 1:2024 adds that the organization must decide whether climate change is a relevant issue (the amendment text is held only as the verbatim quotation in the NQA implementation guide).
What the guidance adds
The guidance turns context into a working record. It asks the team to look outward at the market, law, technology and threats, and inward at culture, capability, structure and appetite, then to show where each issue lands in the scope, the risk work or an objective. The climate question introduced by the amendment belongs in the same record, with a dated decision either way.
Status of the guidance. The guidance lens for 4.1 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep A documented analysis of internal and external issues (for example a PESTLE or SWOT) tied to the ISMS's intended outcomes, with the date of last review with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- Context of the organizationA documented analysis of internal and external issues (for example a PESTLE or SWOT) tied to the ISMS's intended outcomes, with the date of last review
- Context of the organizationThe recorded decision on whether climate change is a relevant issue, since Amendment 1:2024
- Context of the organizationEvidence that the issues fed the scope (4.3) and the risk and opportunity planning in 6.1.1
- Context of the organizationManagement review minutes showing changes in issues were considered (9.3.2 b)
The question an assessor will ask
An assessor will ask for A documented analysis of internal and external issues (for example a PESTLE or SWOT) tied to the ISMS's intended outcomes, with the date of last review. The test for 4.1 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- The context analysis was written for the first certification and never refreshed
- Issues are listed but nothing traces them into scope or risk planning
- No record of the climate change determination required since 2024
- Only external issues are considered and internal ones such as culture or capability are missing
Before the next audit
Before the next audit, test this against one live record: the context analysis was written for the first certification and never refreshed.