Introducing Understanding Organisation and Context
Clause 4.1 of the ISO 27001 requirements is about understanding your organisation and its context. It marks the entry point into the ISO 27001 standard and underpins the building and management of your Information Security Management System (ISMS). You need to outline how your organisation defines:
- What your ISMS does
- When it does it
- How it does it
Whether you’re after independent ISO 27001 certification or just demonstrating compliance with the standard, taking a ‘top down’ approach to information security will help you build an effective, business led ISMS.
Jump to Topic
- Understanding organisation and context
- How to identify the internal issues
- Organisational issues affecting ISMS outcomes
- Identify external issues using the PESTLE method
- Pre-configured templates and tools
- See how we can help
Achieve your first ISO 27001
Download our free guide to fast and sustainable certification
×
Your ultimate guide to first-time ISO 27001 success
We just need a few details so that we can email you your guide to achieving ISO 27001 first-time
Download your free guide now and if you have any questions at all then Book a Demo or Contact Us. We’ll be happy to help.
What are internal and external issues that might affect the intended outcome of the information security management system?
ISO doesn’t actually offer much help in its explanation of what an internal or external issue might be. For an organisation that is new to information security management it could waste valuable time on just figuring that requirement out.
It is one of the reasons why we developed the ISO 27001 Virtual Coach programme, offering practical guidance and coaching videos, guides and checklists every step of the way to complement the ISMS.online software service itself.
As part of the online coaching for clause 4.1 we encourage a simple yet really useful approach towards identifying internal and external issues, and it is summarised below. How long to spend on these exercises and requirements is a question we often get asked.
It is really down to the culture and nature of the organisation, the people involved, its starting point and the value at risk. As an example, a small well managed organisation with a clear purpose and few people involved might get to its conclusions on internal and external issues affecting the ISMS outcomes over a 10 min cup of tea (especially with all the examples in the Virtual Coach).
However other organisations might take longer. We generally suggest this is a fast brainstorming type exercise that avoids over analysis initially – you will almost certainly identify more internal and external issues as you get into the other requirements and these can easily be added in as the implementation of your information security management system and journey towards better information assurance continues.
100% ISO 27001 success
Your simple, practical, time-saving path to first-time ISO 27001 compliance or certification
Book your demo
How to identify the internal issues that affect the outcomes of an information security management system
Consider the IPOPS acronym below for identifying the internal issues that might affect the outcomes of an ISMS. This might be a whiteboarding exercise, post-it notes session or simply capturing notes that you’ll upload later to demonstrate your understanding of the issues. Get the right people in a room or on the phone and start the conversation!
Look at the image for a really basic example of what might be done and that can be uploaded as part of the evidence, or written up in more detail and tested further with other stakeholders depending on the nature of the organisation. From a UKAS ISO 27001 external auditors perspective they will be looking for confidence that the organisation has understood the issues that might affect the outcome of the ISMS (and documented them) before using that evidence to go forward.
That will then help to identify interested parties, set a scope, document your objectives, build an asset inventory and do information security risk analysis before developing suitable policies and controls in line with the statement of applicability.
It’s all a very logical flow and starts right here with this simple exercise!
Examples of internal issues affecting the intended outcome of an information security management system
We have given a few ideas and examples below of areas where you might find internal issues affecting the outcome of the ISMS but there are many issues that might be considered depending on the organisation, its sector, size, scope and nature of the products and services etc.
We suggest you are practical and ensure that it doesn’t become a major strategy exercise or dissertation thesis when that is not required. It is less about where you ‘bucket’ the internal issue too, the idea of simple portfolio analysis like this is to help the brain trigger the internal issues.
So whether you put them under people, organisation or elsewhere is less important (some may also be external issues too) – it is the identification of the internal or external issues that is important so you can build an information security management system that works for you!
You’ll also consider the nature of the organisation around people e.g. is the philosophy to do everything in house, outsource etc – these aspects all give rise to ‘issues’ that might affect the ISMS.
For example you may be able to control staff internally better than suppliers, but it might be there is an argument to having suppliers with their processes involved because they offer the services you want…..remember that your business goals come first – this is right at the heart of the issues identification – run the business the way you want to and ensure that the ISMS protects your valuable information and that of your interested parties.
All the relevant issues should then be considered for more detailed risk analysis later on – not all issues are actually risks though, and some are more important than others so you might choose to prioritise around the bigger issues. So we would suggest you avoid the risk analysis or any deep consideration of what if at this stage and concentrate on identifying the issues.
Achieve your first ISO 27001
Download your free guide to fast and sustainable certification
×
Your ultimate guide to first-time ISO 27001 success
We just need a few details so that we can email you your guide to achieving ISO 27001 first-time
Download your free guide now and if you have any questions at all then Book a Demo or Contact Us. We’ll be happy to help.
Simple. Secure. Sustainable.
See our platform in action with a tailored hands-on session based on your needs and goals.
Book your demo
Information as assets that are internal issues affecting ISMS outcomes
What information is created, handled, stored, managed and of real value for the organisation and its interested parties (in line with the stakeholder analysis you’ll do for 4.2 next)? Personal data, sensitive customer ideas and IPR, financial information, brand, codebases etc?
This is right at the heart of the ISMS where the information assets are the foundation for everything else – identifying these assets early on also makes the information asset inventory management easy for A8.1.
Then consider potential issues around the information itself – in particular confidentiality, integrity and availability, taking into account the other areas below as you go for triggering ideas of where the issues might be found.
People related internal issues that might affect the intended outcome of the ISMS
It’s no surprise that human resource security is an important part of the ISMS, indeed Annex A 7 is devoted to it and all the subsequent policies, controls and management is likely to be with people in mind, both internal employees as well as external resources like suppliers.
Therefore consider any existing issues of:
- recruitment e.g. challenges in hiring competent people, high/low staff turnover
- induction – e.g. do they get training on information security right now, is it working
- in life management e.g. keeping them engaged and showing their compliance to the policies and controls, – do staff actually find information security sexy and exciting or is it a cultural challenge to get someone to lock their laptop when going to the toilet
- change of roles and exit e.g. is access to and removal of information assets and services carried out
Organisational internal issues affecting ISMS outcomes
What are the issues facing the organisation that might affect the outcome of the ISMS? As an example, fast growth brings issues of staff and structure that might affect understanding and knowledge of the policies, or that things change so quickly you can’t easily bottom out detailed and consistent processes.
Are there organisation leadership and board or shareholder pressures that will cause issues (these can be positive as well as negative)? International operations will have different cultural norms for the people involved.
Another internal issue associated to people and the organisation might be about the fact you don’t want many of them employed or struggle to find good ones so rely instead on outsourcing. That brings a need for suppliers (and staff in the suppliers) so that’s an issue to tie in with the interested parties analysis you’ll do in 4.2 next.
Products & Services internal issues that might impact the ISMS outcomes
What are the products and services delivered by the organisation and what sort of issues emerge around that which might cause information risk? For example, if the organisation is an innovator and IPR protection is important for product leadership, it’s an issue that needs consideration in the ISMS.
If the organisation relies on large physical property e.g. as a manufacturer that will probably bring more physical security issues, whereas a small cloud software provider might be much more focused on issues like IPR protection from digital hackers and the issues surrounding dependency of their product success and assurance on hosting suppliers etc.
Systems and Processes as internal issues that affect the intended outcome of the ISMS
People often think about computers and digital technology when the ‘system’ word is used. However manual and paper-based systems are also key areas for issues to emerge so remember to consider those for issues too.
Each of the areas bucketed above will have systems and processes involved in it – that might be implicit (we have always done it that way and never documented it) or could be wrapped up in a mass of documentation that no one could ever follow…….having considered the IPOP areas above, think about the systems and processes internal issues around them – for example if you are hiring staff regularly but don’t have a formal process and systems that demonstrate evaluation and screening from an information security perspective, you have an issue (not least because Annex A7 of ISO 27001).
An issue is that you might be hiring people that are going to become the enemy within….either through ignorance of information security or because they are a saboteur and you never considered that…….Its the same with all the systems and processes across the organisation that are in scope for information assurance – what sort of issues emerge where confidentiality, integrity or availability of the information might be at threat?
See our platform features in action
A tailored hands-on session based on your needs and goals
Book your demo
We’re so pleased we found this solution, it made everything fit together more easily.
Operations Manager Amigo
100% of our users pass certification first time
Book your demo
How to identify the external issues affecting an information security management system using the PESTLE method
One of the old favourites for external analysis is PESTLE and it has merit for use in this exercise, again to be kept practical and focused for issues affecting the ISMS outcomes rather than as a deep strategic piece of work. This exercise generally needs much less explanation and you’ll no doubt find it easy enough to go through and consider from an information security perspective.
Again avoid over analysis and trying to force fit things into buckets for the sake of it – something will trigger or it won’t and you can always come back to it later on. The internal issues affecting the outcome of the ISMS will also trigger external issues – for example if the organisation decided that it won’t do everything internally and needs suppliers, then external issues with those suppliers and their PESTLE related aspects come into the mix.
Political external issues affecting the outcomes from an ISMS
What political issues might affect the organisation and affect outcomes? Examples could include Brexit and specific policy changes in a sector that impact investment or growth that might lead to different ways of working, and different approaches to information management.
Politics (and powerful social media players abusing personal data) brought about GDPR which brought about regulatory changes, which increased the pressure on customers, who in turn are forcing suppliers to achieve independently certified ISO 27001 information security management systems to help them manage their overall supply chain risk.
That’s an example of an issue straddling many aspects of PESTLE and its an external issue facing almost all organisations.
Economic external issues affecting the outcomes from an ISMS
How does the economics of your market and the supply chain impact the organisation? Does that lead to more or less issues with suppliers, customers, what information security corners might get cut in a cost reduction arena and lead to increased risk or threat (and of course opportunity too)?
Examples might be cheaper labour, less training and less time for doing the work, or inability to afford decent technological systems that would help improve operations because funds need to be prioritised elsewhere (Tip – look at our business case planner whitepaper for guidance on the return on investment from information security.)
Sociological external issues affecting the outcomes from an ISMS
How is society or your audience demographic changing and affecting your business – for example always on connected citizens offer opportunity and threat, and a generation of staff that sometimes have more/less regard for data brings positives and negatives too.
We’ve made more ISO 27001 progress in the last 2 weeks using ISMS.online than we have in the past year.
Tom Woolrych
Service & Support Manager, The Workforce
Development Trust
Book your demo
Technological external issues affecting the outcomes from an ISMS
How does the increasing pace of technological change create issues for the ISMS outcomes? Daily changes in operating systems being patched versus (say) once a year in the past? That leads to a need for much more dynamic management that many organisations struggle to maintain which, if left unmanaged, increases the threat of a cyber breach and loss becomes more likely.
Where does artificial intelligence, machine learning, cloud, and every other technological buzzword create issues for your organisation externally?
Legislative external issues affecting the outcomes from an ISMS
One of the most common areas of failure in ISO 27001 is the inability to effectively highlight awareness of and then manage application legislation and regulation issues. This part of PESTLE is a great starting point for Annex A18 on compliance – if your auditor knows more than you about the legislation and regulation affecting your organisation (and therefore the ISMS) they will not be impressed.
It goes way beyond data protection, GDPR, computer monitoring, human rights and intellectual property law, so do give this area serious consideration for any information in your scope. You won’t necessarily need a lawyer but showing you have considered the applicable legislation affecting the organisation will make risk treatment, policy & control creation more focused and relevant as well.
It might be that your risk appetite for something is quite high but if an applicable legislation or regulation sets the bar, then you’ll need to develop policies and controls for complying with that rather than just what you might think is okay!
Environmental external issues affecting the outcomes from an ISMS
PESTLE typically treats environmental as the green issue however it can be your broader ‘environment’ as well. Simple considerations around environmental might mean that you aim to use less paper, travel less – great, what are the issues for the ISMS from that?
For example in developing the ISMS might it be an opportunity for changing practices around printing or developing mobile working policies etc – these are a couple of simple ideas that spring up when you think about environmental paper and travel issues.
Broader ‘environment’ issues might be the things going on in your competitors and broader forces (think Porters 5 forces as a simple example) – what external environment issues are happening there that might impact your ISMS outcomes?
You know your bargaining power of customers is increasing around information security. However if your competitors are all getting independently certified to ISO 27001 and you are only thinking about tick box/hand-waving compliance then that’s an external issue you’d want to consider in more depth to be competitive let alone secure and trusted.
ISMS.online comes pre-configured with practical templates and tools for much of the ISMS including this area so you can easily Adopt, Adapt and Add to them, saving huge amounts of time and cost in implementation.
The optional Virtual Coach programme also comes with video coaching on how to do the exercises well and has many examples of internal and external issues to draw from too.
Book a demo now to see how easy implementation can be with ISMS.online and the Virtual Coach by your side.
Achieve your first ISO 27001
Download your free guide to fast and sustainable certification
×
Your ultimate guide to first-time ISO 27001 success
We just need a few details so that we can email you your guide to achieving ISO 27001 first-time
Download your free guide now and if you have any questions at all then Book a Demo or Contact Us. We’ll be happy to help.
We make achieving ISO 27001 easy
Get a 77% headstart
Our ISMS comes pre-configured with tools, frameworks and documentation you can Adopt, Adapt or Add to. Simple.
Your path to success
Our Assured Results Method is designed to get you certified on your first attempt. 100% success rate.
Watch and learn
Forget about time consuming and costly training. Our Virtual Coach video series is available 24/7 to guide you through.
Book your demo
Platform features
We’ve developed a series of intuitive features and toolsets within our platform to save you time and ensure you’re building an ISMS that’s truly sustainable. With ISMS.online you can quickly achieve ISO 27001 certification and then maintain it with ease.
Perfect Policies & Controls
Easily collaborate, create and show you are on top of your documentation at all times
Find out more
Simple Risk Management
Effortlessly address threats & opportunities and dynamically report on performance
Find out more
Measurement & Automated Reporting
Make better decisions and show you are in control with dashboards, KPIs and related reporting
Find out more
Audits, Actions & Reviews
Make light work of corrective actions, improvements, audits and management reviews
Find out more
Mapping & Linking Work
Shine a light on critical relationships and elegantly link areas such as assets, risks, controls and suppliers
Find out more
Easy Asset Management
Select assets from the Asset Bank and create your Asset Inventory with ease
Find out more
Fast, Seamless Integration
Out of the box integrations with your other key business systems to simplify your compliance
Find out more
Other Standards & Regulations
Neatly add in other areas of compliance affecting your organisation to achieve even more
Find out more
Staff Compliance Assurance
Engage staff, suppliers and others with dynamic end-to-end compliance at all times
Find out more
Supply Chain Management
Manage due diligence, contracts, contacts and relationships over their lifecycle
Find out more
Interested Party Management
Visually map and manage interested parties to ensure their needs are clearly addressed
Find out more
Strong Privacy & Security
Strong privacy by design and security controls to match your needs & expectations
Find out more
ISO 27001 requirements
4.1 Understanding the organisation and its context
4.2 Understanding the needs and expectations of interested parties
4.3 Determining the scope of the ISMS
4.4 Information security management system (ISMS)
5.1 Leadership and commitment
5.2 Information Security Policy
5.3 Organisational roles, responsibilities and authorities
6.1 Actions to address risks and opportunities
6.2 Information security objectives and planning to achieve them
7.1 Resources
7.2 Competence
7.3 Awareness
7.4 Communication
7.5 Documented information
8.1 Operational planning and control
8.2 Information security risk assessment
8.3 Information security risk treatment
9.1 Monitoring, measurement, analysis and evaluation
9.2 Internal audit
9.3 Management review
10.1 Nonconformity and corrective action
10.2 Continual improvement
ISO 27001 Annex A Controls
A.5 Information security policies
A.6 Organisation of information security
A.7 Human resource security
A.8 Asset management
A.9 Access control
A.10 Cryptography
A.11 Physical and environmental security
A.12 Operations security
A.13 Communications security
A.14 System acquisition, development, and maintenance
A.15 Supplier relationships
A.16 Information security incident management
A.17 Information security aspects of business continuity management
A.18 Compliance
About ISO 27001
About ISO 27001
Achieve ISO 27001
ISO 27001 Requirements & Controls
Asset management
ISO 27001 Certification
What is an ISMS?
Key considerations for your ISMS
Migrating your ISMS to ISMS.online
ISO 27002 explained
See the ISMS.online platform in action