Context of the Organization
Clause 4 of ISO/IEC 27001 asks the organization to understand why it needs an ISMS before it builds one. This means determining the external and internal issues relevant to its purpose (often summarised as SWOT or PESTLE-style analysis), and identifying interested parties and their requirements. Interested parties include customers, regulators, employees, suppliers, and shareholders; their requirements become inputs to the ISMS scope and risk criteria.
A candidate must understand scope definition (Clause 4.3). The scope statement must be documented and must consider the issues and requirements identified, plus interfaces and dependencies with third parties. A common trap is treating scope as "the whole company" by default-scope can legitimately be a business unit, a service, or a location, but it must be defensible and documented. Another trap: omitting interfaces and dependencies (e.g., outsourced data centres) that affect security.
The ISMS itself (Clause 4.4) must be established, implemented, maintained, and continually improved, including the processes needed and their interactions.
Watch for questions that confuse the context (Clause 4) with leadership (Clause 5) or planning (Clause 6). Context is about understanding the environment; planning is about acting on it through risk and objectives. Also note that interested-party requirements are not automatically adopted-they inform decisions, and the organization decides which are relevant.
Worked example: A hospital defines its ISMS scope as "patient records system and supporting infrastructure at the main campus, including the outsourced backup provider interface." The scope is valid because it names the boundary, the services, and the third-party dependency. A question asking "what must the scope include?" points to documented boundary, applicability, and interfaces-not to a list of every department.
Rule of thumb: context answers where we stand and who cares; scope answers what the ISMS covers.