Get started

Clause 4: Context of the organization

Start by understanding yourself: who you are, who cares about your security, and where your ISMS boundary sits.

4.1 Understanding the organization and its context

Identify internal and external issues that affect your ability to protect information — e.g. market, regulation, technology, culture, climate considerations.

What auditors look for

A considered list of issues that clearly feeds into risk assessment.

Typical evidence

Context analysis (e.g. SWOT/PESTLE), management review minutes.

Playbook

4.1 Understanding the organization and its context
Evidence you need to provide
  1. A short document listing the internal and external issues that affect your security (for example growth plans, remote working, regulations, threats).
  2. Notes from the meeting where these issues were discussed and agreed.
  3. Proof the list is reviewed at least once a year, such as a review date or management review minutes.
  4. Management should be able to explain the main issues and how they shaped your security programme.
Policies & documents

ISMS scope statement

View full guide: 4.1 Understanding the organization and its context

4.2 Understanding the needs and expectations of interested parties

List the people and groups who care about your security (customers, regulators, staff, suppliers) and what they need from you, and which needs you'll address.

What auditors look for

Relevant parties identified, their requirements captured and linked to the ISMS.

Typical evidence

Interested parties register with requirements.

Playbook

4.2 Understanding the needs of interested parties
Evidence you need to provide
  1. A list of your interested parties (customers, staff, regulators, suppliers, investors) and what each one expects from you on security.
  2. Evidence of where these expectations came from, such as contracts, customer security questionnaires or laws.
  3. Proof the list is reviewed regularly.
  4. A note of which expectations you have decided to meet through your security programme.
  5. Be able to explain how a customer requirement turned into something you do.
Policies & documents

ISMS scope statement

View full guide: 4.2 Understanding the needs of interested parties

4.3 Determining the scope of the ISMS

Decide and document what is in and out of the ISMS: locations, teams, systems, services, and interfaces.

What auditors look for

A clear, justified scope that matches reality and the certificate wording.

Typical evidence

ISMS scope statement.

Playbook

4.3 Determining the scope of the information security management system
Evidence you need to provide
  1. Your scope statement: which parts of the business, locations, systems and teams your security programme covers, and anything left out with the reason.
  2. A diagram or description showing connections to things outside scope (such as suppliers or a parent company).
  3. Proof the scope was approved by management.
  4. Be able to explain why anything is excluded.
Policies & documents

ISMS scope statement

View full guide: 4.3 Determining the scope of the information security management system

4.4 Information security management system

Set up, run, maintain and keep improving the ISMS, including the processes it needs and how they interact.

What auditors look for

Evidence the whole system works as a joined-up cycle, not just documents.

Typical evidence

ISMS manual or process map, overall document set.

Playbook

4.4 Information security management system
Evidence you need to provide
  1. A simple overview of how your security programme works: its main processes and how they connect.
  2. Recent records showing the programme runs as a full cycle: risk assessment, controls, internal audit, management review and improvements.
  3. Your planning calendar showing when key activities happen.
  4. Be able to walk through the yearly cycle.
Policies & documents
  1. ISMS scope statement
  2. Information Security Policy (ISMS policy)

View full guide: 4.4 Information security management system

Clause 5