ISO 27001 clause 4.1: internal and external issues, with examples

Context issues are the things inside and outside your organisation that affect your ability to keep information secure and to get what you want from your ISMS. A growing customer base, a move to the cloud, a small team where one person knows everything, a regulator tightening rules: these are all context issues.

They're the starting point for the whole ISMS. Your scope, risks and objectives should all make sense in light of them.

Why it matters

This is clause 4.1 of ISO/IEC 27001:2022. In summary, you must work out the external and internal issues that are relevant to your purpose and that affect your ability to achieve the intended outcomes of the ISMS.

Since the 2024 amendment, you must also decide whether climate change is a relevant issue. For many small organisations the honest answer is "yes, in a small way", for example flooding at a site or heat affecting equipment, or "not significantly", with a reason. Either way, record the decision.

Clause 6.1.1 then asks you to plan for the risks and opportunities these issues create, and clause 9.3 asks management to review changes in them.

Examples

Illustrative issues for a small software company:

• External: large customers increasingly ask for ISO 27001 in tenders (an opportunity if certified, a risk if not); UK GDPR obligations for customer personal data; reliance on one cloud host; a rise in phishing aimed at small firms; climate change, with low relevance because systems are cloud-hosted in multiple locations.
• Internal: a team of 12 with one IT lead (key-person risk); fast growth bringing new starters every month; a mix of company and personal devices; a culture that values speed over process.

For each, note what it means for the ISMS: a risk, an opportunity, or both, and what you'll do about it.

What an auditor looks for

• Issues that are specific to you, not a generic list of threats.
• Both internal and external issues.
• A link to the rest of the ISMS. The issues show up in your scope decisions, risks and objectives.
• A decision on climate change, recorded either way.
• Evidence of review. Changes are discussed at management review.

Common reasons it fails: no record at all (some organisations treat 4.1 as a thinking exercise and write nothing down); a list copied from a template; or issues that never change from year to year.

Common mistakes, and how to keep it manageable

• Writing an essay. A short list with one line of impact per issue is enough.
• Confusing issues with risks. "One IT lead" is an issue; "IT lead leaves and systems can't be recovered" is the risk it creates. Record both, linked.
• Forgetting opportunities. Certification winning bigger contracts is an issue worth recording, and it helps you set objectives.
• Never updating it. Review it at each management review and when the business changes.

How to do it in ClearIMS

1. Open Context issues and add each internal and external issue in a sentence or two.
2. Record what it means for the ISMS: the risk or opportunity it creates and the planned action.
3. Include climate change as an issue, with your decision on how relevant it is.
4. Review it at management review. Changes since the last review feed into the next management review automatically.

Related pages

• ISMS scope: shaped by these issues.
• Interested parties: clause 4.2, the other half of context.
• Risk register: where issues become risks.
• Legal register: for legal and regulatory issues in detail.