Clause 4.1 specifies exactly what must be determined when establishing context: "The organization shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s) of its information security management system." This requirement is about understanding internal and external issues (e.g., culture, capabilities, regulatory environment) that influence the ISMS's effectiveness.