# Clause 4.1: Understanding the organization and its context

Identify the external and internal issues bearing on the organization's purpose that could stop its business continuity management system from delivering the outcomes it is meant to deliver, having regard to its objectives, what it provides, and how much risk, and of what kinds, it is prepared to carry.

Cloud: A cloud customer's context is no longer only its own estate. It includes the services it rents, the regions those run in, the providers and subproviders underneath them, and the customers who depend on the outcome. Write the dependency down before the guidance lands, because the first question an auditor will ask is which of your critical activities sit on somebody else's platform.

Evidence: Documented context analysis naming external and internal issues; Link from each issue to the BCMS outcome it threatens; Evidence the analysis was reviewed when the organization or its market changed; Statement of the risk appetite the analysis was judged against.

Test: List every cloud service that carries a critical activity, with its provider, region and business owner.

Citation: ISO 22301:2019, clause 4.1. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.