PECB ISO 27001 ISO-IEC-27001-Lead-Implementer Question # 50 Topic 6 Discussion

Bytes identified both external and internal issues relevant to its purpose and that impact its ability to achieve the intended ISMS outcomes, including social, cultural, political, legal, financial, technological, and other factors, as well as internal aspects like culture, policies, resources, infrastructure, etc. This approach fully aligns with ISO/IEC 27001:2022 Clause 4.1, which requires organizations to determine both internal and external issues relevant to the ISMS.

“The organization shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s) of its information security management system.”

— ISO/IEC 27001:2022, Clause 4.1