Clause 4: Context of the Organization

Requirement
The organisation must determine relevant interested parties and their requirements, and decide which of those requirements will be addressed through the QMS.

New in 2026: the organisation must monitor and review information about these interested parties and their requirements, and a new note clarifies that relevant interested parties can have requirements related to climate change.

How to Implement
List your interested parties (regulators, customers, suppliers, shareholders, employees) and their requirements, then build in a periodic refresh, since this is no longer treated as a static list.

When reviewing interested party requirements, specifically check whether any of them (particularly regulators or large customers) now have climate-related expectations, such as carbon reporting, sustainable sourcing, or supply chain resilience commitments.

Mandatory Documents
There is no “shall be available as documented information” requirement for 4.2. No mandatory document is required, though an interested parties register is good practice and supports the new ongoing monitoring expectation.

Requirement
The organisation must determine which interested parties are relevant to the ISMS, as well as what their relevant requirements are.

How to Implement
Start by listing your interested parties, both external (regulators, customers, suppliers, shareholders, industry bodies) and internal (top management, employees, process owners, IT). For each one, identify what they need or expect from you regarding information security, whether that is a legal obligation, a contractual clause, or simply an expectation of confidentiality. Since interested parties and their requirements change as the business grows or as new regulations come into force, review this list periodically.

Mandatory Documents
As with 4.1, ISO 27001:2022 does not explicitly require documented information for this sub-clause, so there is no mandatory document. That said, most organisations find it useful to keep:

• An interested parties register, since it also supports the legal and regulatory requirements log referenced later in Annex A control 5.31

Requirement
The organisation must determine the boundaries and applicability of the QMS, considering the issues from 4.1, the requirements from 4.2, and the products and services it provides. The scope must state the types of products and services covered, must include justification for any requirement of the standard determined not to be applicable, and must be available as documented information.

How to Implement
Draft a scope statement that explicitly names the types of products and services your QMS covers. Where any clause requirement (most commonly 8.3 Design and Development, for organisations that don’t design their own products) is excluded, document the specific justification in the scope statement itself, not in a separate internal memo, since the standard requires the justification to sit within the scope.

Mandatory Documents
Yes, explicitly mandatory. ISO 9001:2026 states: “The scope shall be available as documented information.” You must produce and maintain:

• A formal QMS Scope Statement naming the products/services covered and justifying any exclusions

Requirement
The organisation must establish, implement, maintain, and continually improve a QMS, including determining its processes, their inputs/outputs, sequence and interaction, criteria and methods (including monitoring and performance indicators), required resources, responsibilities and authorities, and how risks and opportunities identified under 6.1 are addressed within those processes. Documented information must be available to support process operation and as evidence that processes are carried out as planned.

How to Implement
Build a process map that shows how your core and support processes interact, who owns each one, what inputs and outputs look like, and how the risks and opportunities you identified in Clause 6 are actually addressed within each process rather than sitting in a separate risk register disconnected from daily operations.

Mandatory Documents
Yes, conditionally mandatory. ISO 9001:2026 states: “Documented information shall be available to the extent necessary to support the operation of processes” and “as evidence that the processes are being carried out as planned.” The exact volume depends on your organisation’s complexity, but typically includes:

• Process maps or procedures for key processes
• Operational records demonstrating processes ran as planned