Organisation & Context

Understanding Your Organization and Context 

The Organization and Context section is crucial for defining key aspects of your business and meeting documentation requirements. It provides a comprehensive view of your organization by detailing customers, company products, third-party involvement, and internal and external factors that may influence operations. 

Understanding your organization’s context is a fundamental step in maintaining a robust Information Security Management System (ISMS) and other compliance frameworks. Organizations must evaluate the broader environment in which they operate to ensure their framework remains effective. This assessment lays the foundation for proactively managing risks, enhancing security, privacy, and quality measures, and ensuring ongoing regulatory compliance. 

Organization and Context involves understanding the key factors that affect your business, including stakeholders, regulations, and the market environment. This helps ensure your operations and goals are aligned. 

Follow these steps for clear and effective management of your organization’s context: 

Step 1: Defining Your Organization 

Start by clearly outlining your organization’s core elements, including: 

• Dive into the essential concept of understanding your business. Define your customers, outline the products your company offers, and identify third parties that contribute to your business ecosystem.  

• Define your product, highlighting its purpose and key features. 

• Identify the product’s target audience and any external parties involved in delivering or supporting the product. 

Step 2: Identifying External and Internal Issues 

Once your organizational context is defined, the next step is assessing external and internal factors that could impact its operations. 

Internal Issues: Expand on the information gathered to explore how to evaluate and document internal factors such as operational inefficiencies, resource constraints, or compliance with contractual obligations e.g.: Organizational structure, security policies, internal processes, and workforce dynamics. 

External Issues: Expand on the information gathered to explore how to evaluate and document external factors, such as market trends, competitors, cyber threats, or regulatory changes e.g.: Market trends, industry regulations, technological advancements, geopolitical factors, cyber threats, and climate change. 

Step 3: Addressing the New Climate Change Amendment 

A key update in ISO 27001:2022 is the addition of climate change as a factor to consider under Clause 4.1. Organizations are now required to determine whether climate change is a relevant issue in their business context. Please note that this requirement may also be relevant to other frameworks; therefore, it is advisable to consider it. 

 To support this, please refer to a dedicated field in the ‘Organization & Context Section’:  “Is climate change a relevant issue?” This allows you to evaluate and document whether climate change poses a risk to your organization’s operations and information security.  

Step 4: Documenting and Reviewing Your Context 

Ensure that all contextual information is clearly documented and regularly updated. To comply, follow these key steps: 

Start by documenting your products/services: 

• Add New: Only include products/services that are currently active and sold to clients. 

• For each product/service, include: 

• Name and short description 

• Key customers and third parties involved 

• Describe how you assess and manage external and internal issues. 

• Review and update this documentation annually to ensure it remains relevant and current 

• Internal issues (e.g., security requirements like data privacy) 

• External issues (e.g., third-party compliance challenges, such as GDPR) 

Additionally, you can refer to your company’s description (e.g., from sales presentation deck or investor materials) and upload it as a document in the system. Keep it brief and concise to ensure clarity!