In my previous two articles in this series focused on developing an Information Security Management System (ISMS) based on ISO 27001:2013, I presented the common myths associated with the standard. In this article, I am going to provide an overview of the standard and section 4 Context of the organisation.
Okay, I know I promised to delve into and discuss the requirements defined in 4 Context of the organisation. However, I realised that they are other common myths that I should dispel for those of you that are interested in implementing an Information Security Management System (ISMS) that conforms with ISO/IEC 27001:2013 (ISO 27001).
Perform a search on compliance and you will find that there are many definitions. People have a slightly different view of what compliance means and what is included or not. In general, compliance means conforming, satisfying or adhering to a rule. This rule can be a specification, a policy, a standard, a law, a procedure or a requirement.