## Clause 4: Context of the organization

[Clause 4.1](../../../MoCs/ISO_27001_2022_4.1_MoC%20Understanding%20the%20organization%20and%20its%20context.md), **Understanding the organization and its context**, is all about making sure the organisation understands itself, in order to build a fit for purpose ISMS, tailored to the needs of the organisation.

We distinguish between internal context and external context.

Internal context is about how the organization is structured, who makes decisions, what's the governance and oversight look like, what's the capability and maturity of the organization, etc.

External context is about what's happening in the outside world, what's the legal and regulatory landscape look like, what part of the world are you operating in, what's the economic landscape look like, what's the demands of your customers, etc.

[Clause 4.2](../../../MoCs/ISO_27001_2022_4.2_MoC%20Understanding%20the%20needs%20and%20expectations%20of%20interested%20parties.md) expands on that by treating the **needs and expectations of interested parties**, or stakeholders.

Interested parties in an ISMS can be both internal and external. External interested parties are entities such as customers, regulators, business partners, suppliers, trade unions, etc.

Internal interested parties are people like senior management, systems users, and organizational units like differen teams and departments.

The needs and requirements of all these parties should be examined when building an ISMS.

For instance, if you have a contract with a customer with the obligation to report a major incident involving their data within one business day, the ISMS must provide the necessary capabilities to do so.

[Clause 4.3](../../../MoCs/ISO_27001_2022_4.3_MoC%20Determining%20the%20scope%20of%20the%20information%20security%20management%20system.md) is about **Determining the scope of the ISMS**. An ISMS doesn't necessarily have to be implemented in the entire organization: its scope can be limited to certain organizational units, specific systems, or business processes.
The scope, however, should be credible given the results of Clause 4.1 and 4.2: the organization should be able to logically explain the scope they've chosen.

[Clause 4.4](../../../MoCs/ISO_27001_2022_4.4_MoC%20Information%20security%20management%20system.md) then, states the requirement to have a fully functioning ISMS. This can of course only be fullfilled after all the other clauses and relevant controls are implemented.

**More about the the organization in its context ([4.1](../../../MoCs/ISO_27001_2022_4.1_MoC%20Understanding%20the%20organization%20and%20its%20context.md))**
Every organization has a mission, or its reason for being. This is often worded in something like a mission statement. 
Organizations also have objectives, expressed in strategy notes, long term goals, high level planning, ambition statements and reports. These can be about launching new products, improving process efficiency or improving quality of service.

This is relevant because an organization implementing ISO 27001 must formulate an information security policy and its objectives. These need to be in line with the organisational goals. If the organization is looking to enter a certain market, which is heavily regulated or where clients enforce strict security regimes, the ISMS must be built to deal with that.

The security strategy should be focused on building security capabilities aligned with the organization's strategic goals, not just on getting ISO 27001 certified.

**More about the stakeholders ([4.2](../../../MoCs/ISO_27001_2022_4.2_MoC%20Understanding%20the%20needs%20and%20expectations%20of%20interested%20parties.md))**
The implementation of an ISMS may affect many interested parties. Internal stakeholders like management, system users and employees may be required to take actions or will experience the consequences of security controls. External stakeholders like regulators may need to be briefed or made aware that this is being implemented. For this it's important to identify the stakeholders and their requirements.

These requirements might be explicit, like the aforementioned customer that requires major incidents to be reported within one business day. They may also be implied, like the expectation of the general public that you will safeguard the data they hand you and abide to relevant laws and regulations.

It's therefore also important that an organisation identifies their legal, regulatory and contractual obligations.

**More about the scope of the ISMS ([4.3](../../../MoCs/ISO_27001_2022_4.3_MoC%20Determining%20the%20scope%20of%20the%20information%20security%20management%20system.md))**
According to this clause, when determining the scope 3 aspects must be taken into account:
a) the external and internal issues from 4.1
b) the stakeholder requirements from 4.2, and:
c) internal and external interfaces and dependencies between organizational activities.

A relevant example is an organization using SaaS software provided by external organizations. Typically, the technology and the activities of the cloud service provider itself will be out of scope for the ISMS, but the responsibilities and processes for overseeing and managing the service delivery òf that provider *will* be in scope.

It is important that the scope of the ISMS, including the argumentation for it, is available as documented information.
