How to identify the external issues?

One of the old favourites for external analysis is PESTLE (Political, Economic, Sociological, Technological, Legal and Environmental) 

Again avoid over analysis and trying to force fit things into buckets for the sake of it – something will trigger or it won’t and you can always come back to it later on. The internal issues affecting the outcome of the ISMS will also trigger external issues – for example if the organisation decided that it won’t do everything internally and needs suppliers, then external issues with those suppliers and their PESTLE related aspects come into the mix.

 

Ref.: https://www.isms.online/iso-27001/4-1-understanding-organisation-and-co…