What is clause 4 of ISO 27001 certification?
Clause 4 of ISO 27001 is one of the most important parts of the certification process because it establishes the foundations of an organisation’s Information Security Management System, commonly known as an ISMS.
Before a business starts writing security policies, assessing risks or selecting information security controls, it needs to understand its organisation, the environment in which it operates and the information security requirements that affect it.
That is exactly what Clause 4 addresses.
ISO/IEC 27001:2022 uses Clause 4 to help organisations define their business context, identify relevant interested parties, determine the boundaries of the ISMS and establish the management system itself.
The clause contains four requirements:
- Clause 4.1: Understanding the organisation and its context
- Clause 4.2: Understanding the needs and expectations of interested parties
- Clause 4.3: Determining the scope of the Information Security Management System
- Clause 4.4: Establishing, implementing, maintaining and continually improving the ISMS
Together, these requirements establish what the ISMS needs to achieve, which business activities it covers and which external and internal factors influence information security.
For businesses approaching certification for the first time, Clause 4 can appear complicated. However, its underlying purpose is straightforward: understand your business before deciding how to protect it.
UK Cyber Compliance provides an automated and AI-driven platform designed to guide organisations through ISO 27001 requirements, including organisational understanding, interested parties, ISMS scope, risk assessment and compliance management.
UK Cyber Compliance (a part of UK Cyber Security Group) provides these services and has a platform to make certification much easier and cheaper.
By bringing these activities into a structured online environment, organisations can reduce manual paperwork while maintaining a clearer relationship between their business requirements and the security controls they need.
what is iso 27001
ISO 27001 is the international requirements standard for establishing, implementing, maintaining and continually improving an Information Security Management System.
The standard helps organisations manage the confidentiality, integrity and availability of information.
Confidentiality means preventing unauthorised access to information.
Integrity means keeping information accurate and protecting it against unauthorised alteration.
Availability means ensuring authorised people can access information and services when they need them.
ISO 27001 considers information security across the whole organisation rather than concentrating exclusively on IT equipment.
It can address employees, suppliers, business operations, customer information, cloud services, physical locations, contracts, applications and information security governance.
The current edition is ISO/IEC 27001:2022, supported by Amendment 1:2024, which addresses climate action considerations.
The International Organization for Standardization confirms that ISO 27001 provides requirements for an ISMS and applies to organisations across different sectors.
Clause 4 establishes the organisational foundation upon which the remaining management system requirements depend.
Why Clause 4 matters before anything else
Many businesses begin ISO 27001 preparation by downloading policy templates or working through Annex A controls.
Although those activities have their place, they should not be the starting point.
Before selecting security controls, the organisation needs to understand which information and business activities require protection.
For example, a company providing cloud software may depend heavily on hosting providers, software developers, customer databases and identity management systems.
A professional services business may depend more heavily on employee laptops, Microsoft 365, confidential client documents and outsourced IT support.
The organisations face different information security risks.
Their customers may have different requirements.
Their suppliers may create different dependencies.
Their ISMS boundaries may also differ.
Clause 4 provides the structure needed to understand these differences before designing the management system.
This can reduce unnecessary work later because the organisation builds its ISMS around genuine business requirements rather than generic assumptions.
Clause 4.1: Understanding the organisation and its context
Clause 4.1 requires an organisation to determine the internal and external issues relevant to its purpose that affect its ability to achieve the intended outcomes of the ISMS.
In simple terms, the organisation needs to understand what happens inside and outside the business that could influence information security.
This includes issues that could create risks, affect operations or influence the organisation’s ability to protect information.
Understanding internal issues
Internal issues arise from the way the organisation operates.
They may include business structure, employees, technology, management arrangements, company culture, resources and operational processes.
For example, consider a business that allows all employees to work remotely.
Remote working may create additional considerations around device security, authentication, confidential conversations and access to business systems.
Another company might depend heavily on one IT administrator.
This creates a potential dependency if that person becomes unavailable.
A growing organisation may experience frequent employee recruitment, new cloud services and changes to internal responsibilities.
Each circumstance can influence information security.
A practical internal context review should consider questions such as:
Who is responsible for information security?
Which business services are critical?
What information does the organisation process?
Which systems support important operations?
Do employees work remotely?
Does the organisation develop software?
How does management make security decisions?
Are important IT functions outsourced?
The purpose is not to document every operational detail.
It is to identify the issues that could meaningfully affect the ISMS.
Understanding external issues
External issues arise outside the organisation but can still influence information security.
These may include cyber threats, legislation, customer expectations, supplier dependencies, changes in technology, economic conditions and contractual commitments.
For example, a business supplying government organisations may face specific security requirements.
A company processing customer information may need to consider UK GDPR obligations.
An organisation dependent on cloud hosting should understand the potential impact of service outages.
A company entering a new market may encounter additional regulatory or customer requirements.
These external issues help management understand the environment in which the business operates.
The resulting information should influence later decisions about risk, controls and resources.
The 2024 climate-action amendment affects Clause 4
One important change to Clause 4 came through ISO/IEC 27001:2022 Amendment 1:2024.
The amendment requires organisations to determine whether climate change represents a relevant issue for their management system.
It also clarifies that relevant interested parties may have requirements connected with climate change.
The amendment does not mean every business must create a separate environmental management programme to achieve ISO 27001.
Instead, the organisation needs to consider whether climate-related circumstances could affect its information security management system.
For example, a company operating its own data centre may need to consider whether extreme temperatures, flooding or other environmental events could affect availability.
Another business might depend on a hosting provider operating in an area exposed to significant environmental disruption.
A third organisation may determine that climate change does not currently create a material issue for the intended outcomes of its ISMS.
The important point is to make a reasoned determination.
Where climate-related issues are relevant, the organisation should consider them within its existing management system arrangements.
The current amendment is available through ISO’s official publication.
How should a business document Clause 4.1?
ISO 27001 does not explicitly require a standalone context register under Clause 4.1.
However, organisations need to demonstrate that they have identified and considered relevant internal and external issues.
Maintaining a structured context record is often the easiest way to achieve this.
A useful record can identify the issue, explain why it matters, describe its potential information security effect and assign responsibility for review.
For example:
Internal issue: Heavy dependence on Microsoft 365.
Potential effect: A major service outage or compromised administrator account could disrupt business operations.
Management consideration: Appropriate access controls, resilience arrangements and supplier dependency management.
Another example might be:
External issue: Changing customer information security requirements.
Potential effect: Existing controls may no longer satisfy important contractual obligations.
Management consideration: Review customer requirements and assess whether additional controls are necessary.
These records should remain practical.
An auditor will be more interested in whether the organisation understands the issues than whether it has created an impressive-looking document.
Clause 4.2: Understanding the needs and expectations of interested parties
Clause 4.2 moves the focus from the organisation’s operating environment to the people and organisations that have relevant information security requirements.
ISO 27001 calls these interested parties.
They can exist inside or outside the business.
Typical interested parties include customers, employees, regulators, suppliers, business partners, shareholders and insurers.
However, the organisation should not simply create a generic list.
It needs to determine which parties are relevant to its ISMS, identify their relevant requirements and decide which requirements the management system will address.
This final decision is particularly important under ISO/IEC 27001:2022.
A business must do more than recognise that customers expect information security.
It needs to understand how relevant customer requirements influence the ISMS.
Identifying the right interested parties
Consider a managed IT services company.
Its customers expect their information to remain secure and its services to remain available.
Employees need clear responsibilities, appropriate training and secure systems.
Regulators may establish requirements relating to personal information.
Cloud suppliers create dependencies and contractual responsibilities.
Senior management expects risks to receive appropriate consideration.
Each interested party has a different relationship with the organisation.
The assessment should explain why the party matters and what information security requirements need attention.
What should an interested parties record contain?
A practical register might identify:
Interested party: Customers.
Relevant requirement: Appropriate confidentiality, secure access, availability and contractual security commitments.
How the ISMS addresses it: Risk assessment, access management, supplier controls, monitoring and relevant policies.
Another entry might identify:
Interested party: Employees.
Relevant requirement: Clear information security responsibilities, secure working arrangements and appropriate protection of employee information.
How the ISMS addresses it: Employee awareness, access controls, HR security processes and data protection arrangements.
The organisation should review this information when relationships or requirements change.
Separate requirements from general expectations
An important part of Clause 4.2 involves understanding which expectations create actual obligations.
For example, a customer may generally expect the organisation to maintain strong information security.
That expectation can influence the organisation’s ISMS.
However, a signed contract might contain a specific requirement to report certain incidents within a defined period.
That represents a more explicit obligation.
Likewise, relevant data protection legislation can establish legal duties.
The organisation should distinguish between these situations and understand which requirements it must meet.
A current October 2026 article from URM Consulting also highlights that Clause 4.2 requires organisations to determine which interested party requirements they will address through the ISMS.
Not every informal preference automatically becomes a mandatory security requirement.
The organisation should make informed decisions while respecting applicable legal and contractual obligations.
How interested parties influence other ISO 27001 activities
Clause 4.2 should connect naturally with the rest of the ISMS.
A customer requirement may influence the ISMS scope.
A contractual obligation may create a risk treatment requirement.
A regulator’s expectations may influence security procedures.
A supplier relationship may create a need for additional monitoring.
For example, a cloud service provider delivering services to public-sector customers might identify requirements involving confidentiality, service availability and incident notification.
These requirements could influence risk assessments, access management, monitoring, supplier arrangements and information security objectives.
The important point is traceability.
An organisation should understand how its relevant obligations affect its information security decisions.
Clause 4.3: Determining the scope of the ISMS
Clause 4.3 requires organisations to determine the boundaries and applicability of the Information Security Management System.
This is commonly known as defining the ISMS scope.
The scope establishes which activities, services, locations and organisational functions the management system covers.
It is particularly important because the certification audit examines the ISMS against the declared scope.
Unlike the context and interested parties assessments, Clause 4.3 explicitly requires the ISMS scope to be available as documented information.
This means the organisation needs a clear written scope statement.
What should an ISMS scope include?
A good scope should explain the organisation or legal entity involved, the business activities covered and the boundaries of the management system.
Depending on the business, it may identify:
- Business services and activities
- Relevant locations and operational functions
- Employees and business roles
- Supporting systems and cloud environments
- Important supplier relationships
- Information and services requiring protection
- Interfaces and dependencies with other parts of the organisation
The scope should also consider relevant internal and external issues and interested party requirements identified under Clauses 4.1 and 4.2.
These earlier assessments directly influence which activities the organisation needs to bring within its management system.
The difference between company-wide and limited scope
A business may decide to include its entire organisation within the ISMS.
Another organisation may establish a scope covering specific business services and supporting functions.
Both approaches can be appropriate.
The important requirement is that the boundary makes sense.
For example, a company delivering a cloud-based software platform might define its ISMS around the development, hosting, management and support of that service.
However, the business should also consider the employees, suppliers, information and supporting infrastructure that affect the security of the service.
It would be difficult to justify excluding an important administrator or cloud environment simply because including it creates additional work.
The scope needs to reflect the organisation’s real activities.
Why an artificially narrow scope creates problems
Some businesses attempt to make ISO 27001 easier by excluding complicated systems or departments.
That approach can create problems during the certification audit.
An auditor may question whether the scope adequately considers the interfaces and dependencies that affect the ISMS.
For example, a business might include its customer portal but exclude the identity management platform used to administer it.
If the excluded system materially affects the portal’s security, the auditor may challenge the reasoning.
A better approach is to establish a credible scope from the beginning.
Include relevant dependencies and explain boundaries clearly.
A well-defined scope can make certification easier because the organisation knows exactly what it needs to manage and demonstrate.
Cloud services and remote workers need attention
Modern businesses rarely operate entirely within one office.
Employees may work from home, access Microsoft 365, use cloud applications or connect to company services from customer locations.
Scope needs to reflect these arrangements.
Consider how people access information and which systems support the activities inside the ISMS.
Cloud services also create external dependencies.
A supplier may operate the underlying infrastructure while your organisation remains responsible for user access, information handling and other controls.
Do not exclude a system merely because another company hosts it.
Understand how that service affects your security responsibilities and the ISMS boundary.
How the scope affects risk assessment
The scope provides the boundary for information security risk assessment.
If the ISMS covers a customer service platform, the risk assessment needs to consider the relevant information, systems, people, processes and dependencies supporting that platform.
A scope covering the whole company will normally require a broader assessment.
This is why Clause 4 should come before the detailed risk assessment under Clause 6.
The organisation needs to know what it is protecting before evaluating how that information or service could be compromised.
A clear scope also helps identify which risk owners should participate in the assessment.
How the scope affects Annex A controls
ISO/IEC 27001:2022 Annex A contains 93 information security controls.
These controls sit across organisational, people, physical and technological security areas.
They provide a reference set that helps organisations assess whether their risk treatment arrangements have overlooked necessary controls.
The ISMS scope influences which controls become relevant.
For example, a company operating a cloud platform may need strong controls around cloud service security, privileged access, information transfer and supplier relationships.
A business with physical premises may need particular attention to physical access and equipment protection.
An organisation employing remote workers may need additional controls that support secure working outside the office.
The scope, risks and requirements should therefore guide control selection.
The organisation records its necessary controls and relevant exclusions within the Statement of Applicability.
Clause 4.4: Establishing and maintaining the ISMS
Clause 4.4 requires the organisation to establish, implement, maintain and continually improve its ISMS in accordance with ISO 27001.
This includes the processes needed for the management system and their interactions.
Clause 4.4 brings the previous three requirements together.
The organisation now understands its business context.
It knows which interested parties matter.
It has determined the ISMS boundaries.
The next step is to create a functioning management system that manages information security within those boundaries.
This involves leadership, planning, risk management, controls, operational processes, monitoring, internal audit, management review and improvement.
What does a functioning ISMS look like?
A working ISMS should become part of normal business management.
Employees understand their security responsibilities.
Management knows which significant information security risks affect the business.
Risks have appropriate owners.
Security controls operate according to the organisation’s requirements.
Policies reflect real working practices.
Incidents receive appropriate handling.
Important suppliers receive relevant oversight.
Internal audits examine whether processes work.
Management reviews performance and approves improvements.
The organisation also responds when new risks, requirements or operational changes arise.
Clause 4.4 does not mean you need a separate management system for every activity.
Information security can become part of existing HR, procurement, IT, operational and governance processes.
That approach often makes ISO 27001 easier to maintain.
What documentation does an auditor expect for Clause 4?
Clause 4 does not prescribe a large collection of individual documents.
However, an auditor needs evidence that the organisation has met its requirements.
The most important mandatory documented item within Clause 4 is the ISMS scope statement under Clause 4.3.
Many organisations also maintain supporting records such as a context assessment, interested parties register, business process map and responsibility records.
These supporting documents can make evidence easier to present, but Clauses 4.1 and 4.2 do not independently demand particular registers by name.
Other parts of ISO 27001 establish additional documented information requirements.
An auditor may therefore examine the relationship between Clause 4 and the wider ISMS.
For example, they may compare your interested party requirements with the risk register or review whether the scope matches the organisation’s actual services.
The objective is to demonstrate that the ISMS reflects the real business.
Common Clause 4 mistakes to avoid
One frequent mistake is copying generic organisational issues from another company’s context assessment.
Another is identifying interested parties without explaining their relevant requirements.
Some organisations create a scope that does not match their actual operations.
Others complete Clause 4 during initial certification preparation and never review it again.
These weaknesses can create inconsistencies elsewhere in the ISMS.
A customer requirement may disappear from the risk assessment.
An important supplier may remain outside consideration.
A new service may operate beyond the existing scope.
The best approach is to make Clause 4 part of normal management review and change management.
Revisit relevant information when the organisation changes.
When should Clause 4 receive another review?
Clause 4 should not become a document that employees complete once and forget.
Organisations should review relevant context, interested party requirements and scope when important changes happen.
Examples include:
- New business services
- Major customer contracts
- Business acquisitions
- New offices or working arrangements
- Changes to important suppliers
- New legal or regulatory obligations
- Major technology changes
- Significant information security incidents
- Changes to the organisation’s strategic direction
Management review under Clause 9 should also consider relevant changes that affect the ISMS.
A periodic review can help maintain confidence that the information remains current.
How UK Cyber Compliance simplifies Clause 4
Managing Clause 4 manually can involve multiple spreadsheets, documents and meetings.
Interested party requirements may sit in one register.
Context issues may sit in another.
The scope may exist in a separate Word document.
Risk records and controls may then use information from all three.
This can create duplication and inconsistent updates.
UK Cyber Compliance provides a guided and AI-driven ISO 27001 platform designed to help organisations manage these connected requirements.
The platform includes structured workflows, risk management, control tracking, policy generation, progress dashboards and audit-ready reporting.
These functions can help businesses organise the information required for Clause 4 and connect it with later ISMS activities.
A structured platform does not remove the need for management decisions.
The business must still determine which issues matter, which interested party requirements apply and which activities belong inside its ISMS scope.
Automation can make those decisions easier to document, track and review.
Who needs iso 27001 certification
ISO 27001 can benefit organisations operating across many sectors.
Technology businesses, managed service providers, professional services firms, healthcare organisations, charities, education providers, manufacturers and public-sector suppliers may all have reasons to pursue certification.
Businesses often seek ISO 27001 because customers require independent information security assurance.
Others use it to strengthen internal governance, manage risks more consistently or support procurement opportunities.
ISO 27001 does not require every organisation to seek independent certification.
Businesses can implement an ISMS without obtaining a certificate.
Certification becomes particularly useful when customers, regulators, partners or contractual requirements call for externally assessed information security management.
Regardless of sector, Clause 4 remains fundamental because it ensures the ISMS reflects the organisation’s actual business circumstances.
What is ISO 27001 Certification?
ISO 27001 certification provides independent assessment of an organisation’s Information Security Management System against ISO/IEC 27001.
ISO publishes the standard but does not issue individual company certificates.
An independent certification body conducts the external audit and makes the certification decision.
For organisations seeking UKAS-accredited certification, the certification body needs appropriate accreditation for ISO 27001.
Businesses can verify accredited management system certificates through UKAS CertCheck.
An automated compliance platform helps prepare and manage the ISMS.
However, completing its compliance workflows does not automatically mean that an independently accredited certificate has been awarded.
The external certification process remains separate.
ISO 27001 Certification Levels
ISO 27001 does not have official bronze, silver, gold or other graded certification levels.
An organisation defines the scope of its ISMS and demonstrates conformity with the requirements of the standard.
The certification process normally involves two initial audit stages.
Stage 1 examines readiness and core management system arrangements.
Stage 2 examines implementation and effectiveness.
Following successful certification, surveillance audits and later recertification help maintain independent assurance.
Clause 4 remains relevant throughout this process.
The organisation needs to ensure its context, interested party requirements and ISMS scope remain suitable as the business changes.
How the Certification Works
The certification process begins with understanding the organisation.
Clause 4 establishes the context, interested parties, scope and overall ISMS.
Clause 5 then addresses leadership, policy and responsibilities.
Clause 6 requires planning, information security risk assessment, risk treatment, the Statement of Applicability and information security objectives.
Clause 7 covers support, including resources, competence, awareness, communication and documented information.
Clause 8 focuses on operational activities.
Clause 9 addresses monitoring, internal audit and management review.
Clause 10 requires continual improvement and appropriate corrective action.
The organisation then needs to demonstrate that these requirements operate together as one management system.
External certification follows through the assessment process conducted by an independent certification body.
BSI confirms that the mandatory management system requirements for certification sit within Clauses 4 to 10 and that the initial certification process uses a two-stage audit.
Further information is available through BSI’s ISO 27001 guidance.
Why Clause 4 matters in today’s cyber security environment
Clause 4 helps organisations understand how external threats and internal conditions influence information security.
That matters because cyber risk remains significant for UK businesses.
The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 43 per cent of businesses identified a cyber security breach or attack during the previous twelve months.
This represents approximately 612,000 UK businesses.
The figure reached 65 per cent among medium businesses and 69 per cent among large businesses.
Phishing remained the most commonly identified attack, affecting 38 per cent of businesses.
The survey also found that only 30 per cent of businesses had undertaken a cyber security risk assessment during the previous twelve months.
Furthermore, only 15 per cent reviewed cyber risks associated with immediate suppliers, while 6 per cent reviewed their wider supply chains.
These statistics illustrate why organisational context and interested party requirements deserve careful consideration.
A business cannot manage risks effectively if it does not understand its dependencies, customers, suppliers and operating environment.
The full findings appear in the UK Government Cyber Security Breaches Survey 2025/2026.
Which UK-based firms offer ISO 27001 consultancy services?
UK businesses can obtain ISO 27001 assistance from information security consultants, managed security providers, compliance specialists and automated compliance platform providers.
When choosing support, consider whether the provider understands the complete ISMS rather than focusing only on documentation.
Useful assistance should cover organisational context, interested parties, ISMS scope, leadership responsibilities, risk assessment, risk treatment, Annex A controls, policies, evidence and audit preparation.
UK Cyber Compliance provides an automated and AI-driven ISO 27001 platform supported by structured guidance and access to compliance expertise.
Its platform helps organisations manage the requirements through guided workflows, intelligent risk assessment, compliance tracking and audit-ready reporting.
This approach can be particularly helpful for small and medium-sized businesses that want a clear route to certification without maintaining numerous disconnected spreadsheets and document libraries.
A practical Clause 4 readiness checklist
Before completing Clause 4, your organisation should be able to answer the following questions.
Clause 4.1: Organisational context
Do we understand the internal and external issues that can affect information security?
Have we considered whether climate change is relevant to the ISMS?
Do we understand our critical business dependencies?
Clause 4.2: Interested parties
Have we identified interested parties relevant to the ISMS?
Do we understand their information security requirements?
Have we determined which requirements the ISMS needs to address?
Clause 4.3: ISMS scope
Does our scope clearly describe the relevant business activities?
Have we considered locations, systems, people and important dependencies?
Are the boundaries credible and appropriately documented?
Clause 4.4: Establishing the ISMS
Have we established the processes needed to manage information security?
Are responsibilities clear?
Does the ISMS connect with risk assessment, controls, monitoring and improvement?
Can we demonstrate that the management system actually operates?
If several answers remain unclear, strengthen those areas before moving further through certification preparation.
Building a stronger ISMS starts with Clause 4
Clause 4 is not simply an administrative requirement.
It establishes the business foundation for everything that follows.
Understanding internal and external issues helps the organisation recognise the circumstances affecting information security.
Identifying interested parties makes relevant obligations and expectations clearer.
Defining scope establishes which activities and services the ISMS protects.
Establishing the management system brings those decisions together.
The remaining ISO 27001 clauses then build upon this foundation through leadership, planning, risk management, security controls, monitoring and continual improvement.
For smaller businesses, the process does not need to become unnecessarily complicated.
The organisation should focus on understanding its real operations and recording the information that matters.
UK Cyber Compliance supports this approach through an automated and AI-driven platform that helps connect organisational understanding, interested party requirements, ISMS scope, risk assessment, controls and audit preparation.
By reducing repetitive administration and providing structured guidance, businesses can approach ISO 27001 certification with greater clarity and confidence.
The strongest ISMS begins with an accurate understanding of the organisation.
When Clause 4 reflects the way the business actually operates, the rest of ISO 27001 becomes easier to manage, easier to maintain and easier to demonstrate during the independent certification audit.
UK Cyber Compliance is here to help
For more information, please do get in touch.
Please check out our Free Cyber Insurance
Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,
If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks.