Context of the organization

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

The organization has to identify the internal and external issues that bear on its purpose and that influence whether its ISMS can deliver the outcomes intended for it. The note links this to establishing external and internal context in ISO 31000:2018, 5.4.1. Amendment 1:2024 adds that the organization must decide whether climate change is a relevant issue (the amendment's wording is held only as quoted in a third-party implementation guide).

How the 2020 guidance taught the audit

Auditors confirm that the organization has a high-level, strategic understanding of the important issues that can help or hinder its ISMS, and knows which external and internal issues relevant to its purpose bear on the ISMS achieving its intended outcomes. Possible sources of such issues include environmental conditions (climate, pollution, resource availability), the outside world at every geographic level (culture, society, politics, law and regulation, finance, technology, the economy, nature and competitors), internal characteristics such as governance, information flows, decision making, policy and strategy, culture, adopted standards and models, product and service life cycles and the technology underpinning the ISMS, and trends from audits and risk assessments. Auditors also look at whether the topics the organization debates are changing and whether the knowledge gained steers how the ISMS is planned, run and operated, including the risk process that protects confidentiality, integrity and availability.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

Amendment 1:2024 adds a decision: the organisation must determine whether climate change is relevant to its context. The 2020 audit row predates that decision, so the auditor now asks for it and for its effect on risk, controls and emergency planning.

Evidence an auditor asks for

• ContextStrategy papers, context analyses or board minutes in which the important issues affecting the ISMS are named
• ContextStatement of the organization's purpose and the ISMS's intended outcomes
• ContextInterview record with top management on the issues identified and how they changed
• ContextTrace from the named issues into the scope, the risk assessment and management review inputs

The questions an auditor will ask

Ask for the context analysis and then for the dated climate change decision, with the reasoning. Trace one climate-related issue into the risk assessment and the emergency plan.

Common gaps

• Organization cannot name the issues it considered, or names only generic IT issues
• Issues identified once and never revisited as the business or threat landscape changed
• No visible link between the issues and the scope, policy or risk assessment

Prepare before the next audit

Re-date the context analysis and record the climate decision. If climate is relevant, show where it changes a risk, a control or a continuity arrangement.

Cross-references