Clause 4 - Context of the Organization

Clause 4 requires the organization to identify internal and external issues that affect its information security objectives, determine the needs and expectations of relevant interested parties, define the scope of its information security management system, and establish the system for managing information security risks.