Understanding the needs and expectations of interested parties
The organization has to work out which interested parties matter to the ISMS, what those parties require, and which of their requirements the ISMS will deal with.
What the requirement asks
The organization has to work out which interested parties matter to the ISMS, what those parties require, and which of their requirements the ISMS will deal with. The note says such requirements may include legal, regulatory and contractual obligations. Amendment 1:2024 adds a note that relevant interested parties can have requirements related to climate change (held as the NQA guide's quotation).
What the guidance adds
The guidance separates a stakeholder list from a requirements list. For each interested party it asks what they actually require of the ISMS, which of those requirements the organization adopts and where the obligation is discharged. A list of names with no requirement and no owner is not an analysis.
Status of the guidance. The guidance lens for 4.2 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep A register of relevant interested parties such as customers, regulators, staff, suppliers and shareholders, with their information security requirements with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- Interested partiesA register of relevant interested parties such as customers, regulators, staff, suppliers and shareholders, with their information security requirements
- Interested partiesA record of which requirements the ISMS will address and which it will not, with reasons
- Interested partiesLinks from legal, regulatory and contractual obligations in the register to the controls or processes that meet them
- Interested partiesEvidence the register is reviewed, for example as a management review input
The question an assessor will ask
An assessor will ask for A register of relevant interested parties such as customers, regulators, staff, suppliers and shareholders, with their information security requirements. The test for 4.2 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- Parties are listed without stating what they actually require
- No decision is recorded on which requirements the ISMS takes on
- Contractual security obligations from customer contracts are missing
- Climate-related requirements of interested parties are not considered after the 2024 amendment
Before the next audit
Before the next audit, test this against one live record: parties are listed without stating what they actually require.