The context of the organisation describes what influences your ISMS: internal and external issues, the interested parties with their requirements and, derived from these, the scope (ISO/IEC 27001, clauses 4.1–4.3). This guide is aimed at ISMS managers who maintain the context and at top management, who approve the scope.

Before you start

  • You will find everything under ISMS management › Context with the tabs Scope, Issues, Interested parties (stakeholders) and Communication.
  • Issues and parties are maintained by people with the “Context: Maintain” permission; by default, these are the ISMS managers. Another person with the “Approve scope” permission may approve the scope; by default, this is top management.
  • The context is included in all plans.

Recording issues

  1. Open Context › Issues and click Record issue.
  2. Choose the Type (Internal or External) and name the Issue, for example “Revised Data Protection Act (revFADP)” or “Critical systems depend on one person”.
  3. Under Effect on the ISMS, describe how the issue influences whether your ISMS achieves its objectives. The field is required; risks and opportunities follow from it.
  4. Click Save.

On the same page, you assess whether Climate change is relevant to your organisation (ISO/IEC 27001:2022/Amd 1:2024): Yes, relevant or No, not relevant, each with a justification. If it is relevant, you record its effects as an issue and tick Relates to climate change.

If an issue is no longer relevant, open it and select No longer relevant (archive).

Recording interested parties

  1. Open Context › Interested parties (stakeholders) and click Record party.
  2. Name the Party, for example “Customers in the healthcare sector”, and, if set up, choose a Category.
  3. Under Requirements, record what the party expects of your information security (ISO/IEC 27001, 4.2 b), for example “Incidents reported within 24 h”.
  4. Under How the ISMS addresses them, describe how the ISMS meets the requirements or why they lie outside the ISMS (4.2 c). Both fields are required.
  5. Click Save.

Categories are optional; you set them up under ISMS settings › Organisation & roles › Interested parties (the notice at the top of the parties page takes you straight there). You archive a party that is not (or no longer) relevant, with a justification, via Not (or no longer) relevant – archive. It is kept as evidence of your review.

Opportunities and communication

For issues and parties, you can optionally record an opportunity with Record opportunity and link it to a measure or an objective; only then is it considered planned (6.1.1). For parties, you use Define communication to define what you communicate about, when and how, and who is responsible, or you choose No communication needed with a justification (7.4). The Communication tab shows the overview as a communication matrix.

Defining and approving the scope

  1. Open Context › Scope and click Define the scope (later Create new version).
  2. Describe the Scope and add Boundaries, Interfaces and dependencies and Exclusions with justification.
  3. Save. Another person with the “Approve scope” permission receives a task.
  4. The approver chooses Approve or Reject with a justification. After a rejection, the person who created the draft revises it; it is then submitted for approval again.

The person who created the draft never approves it themselves (four-eyes principle), see Managing approvals with the four-eyes principle. Approved versions cannot be changed; changes require a new version. Earlier versions are kept as evidence.

What happens next

  • The valid version of the scope replaces the previous one; from then on, the management review shows this version.
  • Changed issues and parties and the climate change assessment feed into the next management review, see Preparing and conducting the management review.

Frequently asked questions

Do I have to use categories for parties?

No. By default, you record parties without categories. If you want to structure many parties, you can set up your own categories.

Why does an issue show “Effect missing”?

The issue was recorded without an effect on the ISMS. Add the effect; only then can it be saved again.

We have already approved the scope outside Varmo.

Adopt the existing approval during setup, see Setup step by step.