Understanding the organization and its context

Plain-language summary

Working out which internal and external issues shape your ability to protect information — the business you are in, the technology you depend on, the threats you face, the law you work under — and, since Amendment 1 (2024), whether climate change is a relevant issue.

What the clause is really asking

An ISMS built in a vacuum protects the wrong things. The clause wants you to look outward and inward before you design anything: the markets and customers who hand you their data, the regulators and contracts that bind you (POPIA, GDPR, PCI DSS, customer security schedules), the threat landscape for your sector, your supply chain and cloud dependencies, your own culture, skills, legacy systems and appetite for risk. Nothing here has to be documented in a prescribed form, but the output must visibly feed the scope (4.3) and the planning of risks and opportunities (6.1.1), and changes in it come back as a management-review input (9.3.2). Amendment 1 adds one line: decide, and be able to say, whether climate change is a relevant issue — for most organisations it lands as availability risk (flooding, heat, power instability, supplier disruption) rather than confidentiality. If you already run ISO 9001, this is the same requirement as its clause 4.1, applied to information risk; reuse the context analysis and extend it.

What auditors look for

Auditors open with 'what are the issues that affect your information security?' and listen for specifics rather than a generic SWOT. They look for the link from issue to action: a named dependency on one cloud provider should appear in the risk register; a new customer security schedule should appear in the requirements list. They check that the context analysis was reviewed when something changed (a new site, a ransomware wave in your sector, a new regulation) and that it was an input to management review. On the climate amendment they simply ask whether the question was considered and where the answer is written down — a one-line 'not relevant, because…' passes; silence does not.

Typical evidence

Context analysis (SWOT, PESTLE or an issues register) with an information-security lens; threat-landscape notes for the sector; a list of technology, supplier and cloud dependencies; the explicit climate-change relevance decision; management-review inputs showing changes in issues; links from issues to risks in the risk register.

How to comply — recommendations

Run the context exercise as a two-hour workshop with IT, the business owners of key processes and whoever handles legal and contracts, using one page per heading: who relies on us, what we rely on, what could hurt us, what the law and our contracts demand. Write the climate line in the same document. Date it, name an owner, and put 'changes in context' on the management-review agenda so it is revisited at least annually. Then make the links visible: every significant issue should either become a risk, a requirement or an objective — or carry a one-line reason why not.

Common nonconformities

Context analysis missing, generic or copied from a template; no visible link from identified issues to risks or objectives; context never reviewed after a significant change; climate change not considered at all (post-Amendment 1 audits now ask); context does not mention the regulatory and contractual requirements the ISMS exists to meet.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.