ISO 27001:2022の4.1項によれば、組織は、その目的に関連し、情報セキュリティマネジメントシステム（ISMS）の意図された成果を達成する能力に影響を与える外部および内部の問題を特定しなければならない。12 外部の問題とは、組織が制御できないが、影響を与えたり適応したりできる外部の要因である。これには、組織の情報セキュリティの目的、リスク、機会に影響を与える可能性のある政治的、経済的、社会的、技術的、法的、環境的要因が含まれる。12 内部の問題とは、組織が制御または変更できる組織内の要因である。これには、組織の情報セキュリティマネジメントシステムに影響を与える可能性のある組織の構造、文化、価値観、方針、目的、戦略、能力、リソース、プロセス、活動、関係、パフォーマンスが含まれる。12 したがって、ISOのマネジメントシステムの文脈では、以下の問題が「内部」とみなされる。
27001:2022:
Poor levels of staff competence as a result of cuts in training expenditure: This is an internal issue because it relates to the organisation's capability, resource, and process of developing and maintaining the competence of its personnel involved in the ISMS. The organisation can control or change its training expenditure and its impact on staff competence12 Poor morale as a result of staff holidays being reduced: This is an internal issue because it relates to the organisation's culture, value, and relationship with its employees. The organisation can control or change its staff holiday policy and its impact on staff morale12 Increased absenteeism as a result of poor management: This is an internal issue because it relates to the organisation's performance, structure, and accountability of its management. The organisation can control or change its management practices and its impact on staff absenteeism12 A fall in productivity linked to outdated production equipment: This is an internal issue because it relates to the organisation's capability, resource, and process of ensuring the availability and suitability of its production equipment. The organisation can control or change its equipment maintenance and upgrade and its impact on productivity12 The following issues are considered 'external' in the context of a management system to ISO 27001:2022:
Higher labour costs as a result of an aging population: This is an external issue because it relates to the social and demographic factor that affects the availability and cost of labour in the market. The organisation cannot control or change the aging population, but can influence or adapt to its impact on labour costs12 A rise in interest rates in response to high inflation: This is an external issue because it relates to the economic and monetary factor that affects the cost and availability of capital in the market. The organisation cannot control or change the interest rates or inflation, but can influence or adapt to its impact on capital costs12 A reduction in grants as a result of a change in government policy: This is an external issue because it relates to the political and legal factor that affects the availability and conditions of public funding for the organisation. The organisation cannot control or change the government policy, but can influence or adapt to its impact on grants12 Inability to source raw materials due to government sanctions: This is an external issue because it relates to the political and legal factor that affects the availability and cost of raw materials in the market. The organisation cannot control or change the government sanctions, but can influence or adapt to its impact on raw materials12 References:
1: ISO/IEC 27001:2022 Lead Auditor (Information Security Management Systems) Course by CQI and IRCA Certified Training 1 2: ISO/IEC 27001 Lead Auditor Training Course by PECB 2