“The organisation shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s) of its information security management system.”

An organization that wants to be ISO 27001 compliant should at least:

• Be able to demonstrate that its ISMS is aligned with its mission, its objectives and business strategies.
• Identify and document the organization’s activities, functions, services, products, partnerships, supply chains and relationships with interested parties.
• Define the external and internal factors that can influence the ISMS.
• Recognize and take into account issues related to information security within their industrial sector such as risk, legal and regulatory obligations and customer requirements.
• Establish and document objectives for the ISMS.

As both the external and internal issues will change over time, the issues and their influence on the scope, constraints and requirements of the ISMS should be reviewed regularly.

1. Interested parties that are relevant to the information security management system; and
2. The requirements of those interested parties relevant to information security.” 

1. An organisation is a structured entity and is usually registered with a government body. This may be, for example: a company, institution, charity, self-employed, an association or a combination thereof. An organization can be public or private.
2. That said, the use of ‘organisation’ in ISO/IEC 27001 can refer to a component of a registered or otherwise formally established entity, i.e. a separate department, business function, specific geographic location (such as an organization’s data center, but excluding their separate admin offices).
3. “Infrastructure” can be used as a synonym of “supporting asset” as defined by ISO/IEC 27005.
4. The organization’s requirements may come from different interested parties. They can be explicit (defined by contracts, agreements, regulations) or implicit (not documented).

1. the external and internal issues referred to in 4.1;
2. the requirements referred to in 4.2; and
3. interfaces and dependencies between activities performed by the organization, and those that are performed by other organizations.

• What are the mandates for ISMS established by the organizational management and the obligations imposed externally on the organization?
• Is the responsibility held by more than one management team?
• How will the ISMS-related documents be communicated throughout the organization?
  Can the current management systems support the organization’s needs.

• Determine the preliminary scope.
• Determine the refined scope.
• Determine the final scope.
• Approve the scope.

1. Obtain management commitment and authorization to implement the ISMS.
2. Obtain the resources needed to implement and maintain the ISMS.

To sum up, ISO/IEC 27001 certification is the best solution to ensure your commitment in cybersecurity and decrease the data breach of your organisation. It ensures that the business security risk is managed cost-effectively and does the thing the correct way.