Clause 4: Context of the Organization

Requirement
The organisation must determine the external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcomes of its ISMS.

How to Implement
First, review your external environment, including legal and regulatory changes (such as Kenya’s Data Protection Act), economic conditions, technology trends, and competitive pressures. Next, review your internal environment, including company culture, governance structure, existing policies, available resources, and past audit or incident history. A simple way to do this is a PESTLE analysis (Political, Economic, Social, Technological, Legal, Environmental) for external issues, paired with an internal capability review. Because these issues change over time, they should be revisited regularly.

Mandatory Documents
ISO/IEC 27001:2022 does not say documented information on this activity “shall be available.” Consequently, there is no mandatory document for 4.1. However, it is useful, though not required, to keep:

• An internal and external issues register, since this feeds directly into risk assessment in Clause 6

Requirement
The organisation must determine which interested parties are relevant to the ISMS, as well as what their relevant requirements are.

How to Implement
Start by listing your interested parties, both external (regulators, customers, suppliers, shareholders, industry bodies) and internal (top management, employees, process owners, IT). For each one, identify what they need or expect from you regarding information security, whether that is a legal obligation, a contractual clause, or simply an expectation of confidentiality. Since interested parties and their requirements change as the business grows or as new regulations come into force, review this list periodically.

Mandatory Documents
As with 4.1, ISO 27001:2022 does not explicitly require documented information for this sub-clause, so there is no mandatory document. That said, most organisations find it useful to keep:

• An interested parties register, since it also supports the legal and regulatory requirements log referenced later in Annex A control 5.31

Requirement
The organisation must determine the boundaries and applicability of the ISMS, considering the issues from 4.1, the requirements from 4.2, and the interfaces and dependencies between its own activities and those performed by other organisations. The scope must be documented.

How to Implement
Begin by deciding exactly which parts of the business the ISMS will cover, whether that is a single department, a specific service line, or the entire legal entity. Then consider physical locations, IT systems, and any third-party dependencies that fall inside or outside the boundary. Draft a scope statement that is specific and defensible, since it should answer “what, where, and who” for your ISMS. Finally, have top management formally approve it, because auditors will test every subsequent control against this scope.

Mandatory Documents
Yes, this is explicitly mandatory. ISO/IEC 27001:2022 states the scope “shall be available as documented information.” Therefore you must produce and maintain:

• A formal ISMS Scope Statement.

Requirement
The organisation must establish, implement, maintain, and continually improve an ISMS, including the processes needed and their interactions, in accordance with the requirements of the standard.

How to Implement
This sub-clause acts as an umbrella requirement that ties everything else together, since it does not introduce a new activity so much as confirm that all the other clauses, once implemented, together form your ISMS. In practice, this means mapping out how your policies, risk processes, controls, and reviews interact, often visualised as a process map or an ISMS framework diagram.

Mandatory Documents
There is no explicit “shall be available as documented information” requirement tied to 4.4 itself, so no mandatory document is required here specifically. Even so, many organisations produce:

• An ISMS Manual or ISMS Framework Document, as a non-mandatory but useful reference that ties the whole system together for new staff and auditors