Understanding the Organisation and its Context - ISO 27001 Requirement 4.1
What does ISO 27001 Clause 4.1 cover?
Clause 4.1 of the information security management system (ISMS) is to first consider the overall purpose and goals of the organisation. It’s about taking a ‘top down’ approach to information security whether you are seeking independent ISO certification for your management system or whether you simply want to show better compliance towards a recognised standard such as ISO/IEC 27001. From that top down approach you’ll then be much more able to identify the relevant internal and external issues that can affect the intended outcome/s of the ISMS, which is at the heart of this requirement. You’ll also have a better perspective on some of the regulatory compliance issues that could affect the organisation as well and ensure that they are considered at the highest level too.requirements is about understanding the organisation and its context. We always recommend this is where an organisation starts with its ISO 27001 implementation. Why? Well we believe that information security should be about doing business more securely rather than just ticking boxes for information assurance or information risk management in itself. The best way of focusing the attention of a business led
What are internal and external issues that might affect the intended outcome of the information security management system?
ISO doesn’t actually offer much help in its explanation of what an internal or external issue might be. For an organisation that is new to information security management it could waste valuable time on just figuring that requirement out. It is one of the reasons why we developed the ISO 27001 Virtual Coach programme, offering practical guidance and coaching videos, guides and checklists every step of the way to complement the ISMS.online software service itself.
As part of the online coaching for clause 4.1 we encourage a simple yet really useful approach towards identifying internal and external issues, and it is summarised below. How long to spend on these exercises and requirements is a question we often get asked. It is really down to the culture and nature of the organisation, the people involved, its starting point and the value at risk. As an example, a small well managed organisation with a clear purpose and few people involved might get to its conclusions on internal and external issues affecting the ISMS outcomes over a 10 min cup of tea (especially with all the examples in the Virtual Coach). However other organisations might take longer. We generally suggest this is a fast brainstorming type exercise that avoids overanalysis initially – you will almost certainly identify more internal and external issues as you get into the other requirements and these can easily be added in as the implementation of your information security management system and journey towards better information assurance continues.
How to identify the internal issues that affect the outcomes of an information security management system
Consider the IPOPS acronym below for identifying the internal issues that might affect the outcomes of an ISMS. This might be a whiteboarding exercise, post-it notes session or simply capturing notes that you’ll upload later to demonstrate your understanding of the issues. Get the right people in a room or on the phone and start the conversation!
Look at the image for a really basic example of what might be done and that can be uploaded as part of the evidence, or written up in more detail and tested further with other stakeholders depending on the nature of the organisation. From a UKAS ISO 27001 external auditors perspective they will be looking for confidence that the organisation has understood the issues that might affect the outcome of the ISMS (and documented them) before using that evidence to go forward. That will then help to identify interested parties, set a scope, document your objectives, build an asset inventory and do information security risk analysis before developing suitable policies and controls in line with the statement of applicability. It’s all a very logical flow and starts right here with this simple exercise!
Examples of internal issues affecting the intended outcome of an information security management system
We have given a few ideas and examples below of areas where you might find internal issues affecting the outcome of the ISMS but there are many issues that might be considered depending on the organisation, its sector, size, scope and nature of the products and services etc. We suggest you are practical and ensure that it doesn’t become a major strategy exercise or dissertation thesis when that is not required. It is less about where you ‘bucket’ the internal issue too, the idea of simple portfolio analysis like this is to help the brain trigger the internal issues. so whether you put them under people, organisation or elsewhere is less important (some may also be external issues too) – it is the identification of the internal or external issues that is important so you can build an information security management system that works for you!
You’ll also consider the nature of the organisation around people e.g. is the philosophy to do everything in house, outsource etc – these aspects all give rise to ‘issues’ that might affect the ISMS. For example you may be able to control staff internally better than suppliers, but it might be there is an argument to having suppliers with their processes involved because they offer the services you want…..remember that your business goals come first – this is right at the heart of the issues identification – run the business the way you want to and ensure that the ISMS protects your valuable information and that of your interested parties.
All the relevant issues should then be considered for more detailed risk analysis later on – not all issues are actually risks though, and some are more important than others so you might choose to prioritise around the bigger issues. So we would suggest you avoid the risk analysis or any deep consideration of what if at this stage and concentrate on identifying the issues.
Information as assets that are internal issues affecting ISMS outcomes
- What information is created, handled, stored, managed and of real value for the organisation and its interested parties (in line with the stakeholder analysis you’ll do for 4.2 next)? Personal data, sensitive customer ideas and IPR, financial information, brand, codebases etc? This is right at the heart of the ISMS where the information assets are the foundation for everything else – identifying these assets early on also makes the information asset inventory management easy for A8.1. Then consider potential issues around the information itself – in particular confidentiality, integrity and availability, taking into account the other areas below as you go for triggering ideas of where the issues might be found.
People related internal issues that might affect the intended outcome of the ISMS
It’s no surprise that human resource security is an important part of the ISMS, indeed Annex A 7 is devoted to it and all the subsequent policies, controls and management is likely to be with people in mind, both internal employees as well as external resources like suppliers. Therefore consider any existing issues of:
- recruitment e.g. challenges in hiring competent people, high/low staff turnover
- induction – e.g. do they get training on information security right now, is it working
- in life management e.g. keeping them engaged and showing their compliance to the policies and controls, – do staff actually find information security sexy and exciting or is it a cultural challenge to get someone to lock their laptop when going to the toilet…
- change of roles and exit e.g. is access to and removal of information assets and services carried out
Organisational internal issues affecting ISMS outcomes
- What are the issues facing the organisation that might affect the outcome of the ISMS? As an example, fast growth brings issues of staff and structure that might affect understanding and knowledge of the policies, or that things change so quickly you can’t easily bottom out detailed and consistent processes. Are there organisation leadership and board or shareholder pressures that will cause issues (these can be positive as well as negative)? International operations will have different cultural norms for the people involved.
Another internal issue associated to people and the organisation might be about the fact you don’t want many of them employed or struggle to find good ones so rely instead on outsourcing. That brings a need for suppliers (and staff in the suppliers) so that’s an issue to tie in with the interested parties analysis you’ll do in 4.2 next.
Products & Services internal issues that might impact the ISMS outcomes
- What are the products and services delivered by the organisation and what sort of issues emerge around that which might cause information risk? For example, if the organisation is an innovator and IPR protection is important for product leadership, it’s an issue that needs consideration in the ISMS. If the organisation relies on large physical property e.g. as a manufacturer that will probably bring more physical security issues, whereas a small cloud software provider might be much more focused on issues like IPR protection from digital hackers and the issues surrounding dependency of their product success and assurance on hosting suppliers etc.
Systems and Processes as internal issues that affect the intended outcome of the ISMS
- People often think about computers and digital technology when the ‘system’ word is used. However manual and paper-based systems are also key areas for issues to emerge so remember to consider those for issues too. Each of the areas bucketed above will have systems and processes involved in it – that might be implicit (we have always done it that way and never documented it) or could be wrapped up in a mass of documentation that no one could ever follow…….having considered the IPOP areas above, think about the systems and processes internal issues around them – for example if you are hiring staff regularly but don’t have a formal process and systems that demonstrate evaluation and screening from an information security perspective, you have an issue (not least because Annex A7 of ISO 27001.) An issue is that you might be hiring people that are going to become the enemy within….either through ignorance of information security or because they are a saboteur and you never considered that…….Its the same with all the systems and processes across the organisation that are in scope for information assurance – what sort of issues emerge where confidentiality, integrity or availability of the information might be at threat?
How to identify the external issues affecting an information security management system using the PESTLE method
One of the old favourites for external analysis is PESTLE and it has merit for use in this exercise, again to be kept practical and focused for issues affecting the ISMS outcomes rather than as a deep strategic piece of work. This exercise generally needs much less explanation and you’ll no doubt find it easy enough to go through and consider from an information security perspective. Again avoid over analysis and trying to force fit things into buckets for the sake of it – something will trigger or it won’t and you can always come back to it later on. The internal issues affecting the outcome of the ISMS will also trigger external issues – for example if the organisation decided that it won’t do everything internally and needs suppliers, then external issues with those suppliers and their PESTLE related aspects come into the mix.
Political external issues affecting the outcomes from an ISMS
- What political issues might affect the organisation and affect outcomes? Examples could include Brexit and specific policy changes in a sector that impact investment or growth that might lead to different ways of working, and different approaches to information management. Politics (and powerful social media players abusing personal data) brought about GDPR which brought about regulatory changes, which increased the pressure on customers, who in turn are forcing suppliers to achieve independently certified ISO 27001 information security management systems to help them manage their overall supply chain risk. Thats an example of an issue straddling many aspects of PESTLE and its an external issue facing almost all organisations.
Economic external issues affecting the outcomes from an ISMS
- How does the economics of your market and the supply chain impact the organisation? Does that lead to more or less issues with suppliers, customers, what information security corners might get cut in a cost reduction arena and lead to increased risk or threat (and of course opportunity too)? Examples might be cheaper labour, less training and less time for doing the work, or inability to afford decent technological systems that would help improve operations because funds need to be prioritised elsewhere (Tip – look at our business case planner whitepaper for guidance on the return on investment from information security.)
Sociological external issues affecting the outcomes from an ISMS
- How is society or your audience demographic changing and affecting your business – for example always on connected citizens offer opportunity and threat, and a generation of staff that sometimes have more/less regard for data brings positives and negatives too…..
Technological external issues affecting the outcomes from an ISMS
- How does the increasing pace of technological change create issues for the ISMS outcomes? Daily changes in operating systems being patched versus (say) once a year in the past? That leads to a need for much more dynamic management that many organisations struggle to maintain which, if left unmanaged, increases the threat of a cyber breach and loss becomes more likely. Where does artificial intelligence, machine learning, cloud, and every other technological buzzword create issues for your organisation externally?
Legislative external issues affecting the outcomes from an ISMS
- One of the most common areas of failure in ISO 27001 is the inability to effectively highlight awareness of and then manage application legislation and regulation issues. This part of PESTLE is a great starting point for Annex A18 on compliance – if your auditor knows more than you about the legislation and regulation affecting your organisation (and therefore the ISMS) they will not be impressed. It goes way beyond data protection, GDPR, computer monitoring, human rights and intellectual property law, so do give this area serious consideration for any information in your scope. You won’t necessarily need a lawyer but showing you have considered the applicable legislation affecting the organisation will make risk treatment, policy & control creation more focused and relevant as well. It might be that your risk appetite for something is quite high but if an applicable legislation or regulation sets the bar, then you’ll need to develop policies and controls for complying with that rather than just what you might think is okay!
Environmental external issues affecting the outcomes from an ISMS
- PESTLE typically treats environmental as the green issue however it can be your broader ‘environment’ as well. Simple considerations around environmental might mean that you aim to use less paper, travel less – great, what are the issues for the ISMS from that? For example in developing the ISMS might it be an opportunity for changing practices around printing or developing mobile working policies etc – these are a couple of simple ideas that spring up when you think about environmental paper and travel issues.
- Broader ‘environment’ issues might be the things going on in your competitors and broader forces (think Porters 5 forces as a simple example) – what external environment issues are happening there that might impact your ISMS outcomes? You know your bargaining power of customers is increasing around information security. However if your competitors are all getting independently certified to ISO 27001 and you are only thinking about tick box/hand-waving compliance then that’s an external issue you’d want to consider in more depth to be competitive let alone secure and trusted.
ISMS.online comes pre-configured with practical templates and tools for much of the ISMS including this area so you can easily Adopt, Adapt and Add to them, saving huge amounts of time and cost in implementation.
The optional Virtual Coach programme also comes with video coaching on how to do the exercises well and has many examples of internal and external issues to draw from too.
Book a demo now to see how easy implementation can be with ISMS.online and the Virtual Coach by your side.
ISO 27001 Annex A Controls
- A.5 Information security policies
- A.6 Organisation of information security
- A.7 Human resource security
- A.8 Asset management
- A.9 Access control
- A.10 Cryptography
- A.11 Physical and environmental security
- A.12 Operations security
- A.13 Communications security
- A.14 System acquisition, development, and maintenance
- A.15 Supplier relationships
- A.16 Information security incident management
- A.17 Information security aspects of business continuity management
- A.18 Compliance
ISO 27001 requirements
- 4.1 Understanding the organisation and its context
- 4.2 Understanding the needs and expectations of interested parties
- 4.3 Determining the scope of the information security management system
- 4.4 Information security management system
- 5.1 Leadership and commitment
- 5.2 Information Security Policy
- 5.3 Organizational roles, responsibilities and authorities
- 6.1 Actions to address risks and opportunities
- 6.2 Information security objectives and planning to achieve them
- 7.1 Resources
- 7.2 Competence
- 7.3 Awareness
- 7.4 Communication
- 7.5 Documented information
- 8.1 Operational planning and control
- 8.2 Information security risk assessment
- 8.3 Information security risk treatment
- 9.1 Monitoring, measurement, analysis and evaluation
- 9.2 Internal audit
- 9.3 Management review
- 10.1 Nonconformity and corrective action
- 10.2 Continual improvement