The organization shall determine the interested parties that are relevant to the Information Security Management System (ISMS) and identify their relevant requirements related to information security.
Identify interested parties
Typical examples include:
- Internal:
- Employees and management,
- Shareholders/board of directors
- Internal audit/compliance teams
- External:
- Customers and clients,
- Suppliers, contractors, and partners,
- Regulators and certification bodies
- Industry associations and
- The public or media (in case of incidents).
Determine their needs and expectations
You should list both explicit requirements (e.g., contractual terms, laws) and implicit expectations (e.g., confidentiality of data, reliability of service).
Example table:
| Interested Party | Needs (Requirements) | Expectations (Implicit or stated) |
| Customers | Data confidentiality, service uptime, breach notification | Transparent communication, secure payment methods |
| Regulators | Compliance with applicable laws (e.g., GDPR, HIPAA) | Proactive cooperation during audits |
| Employees | Access to necessary systems | Training, safe handling of personal data |
| Suppliers | Clear contractual obligations on data handling | Fair treatment, timely payments |
| Shareholders | Protection of business value | Maintaining reputation, avoiding costly breaches |
Link to ISMS
Once identified, you use these needs and expectations to:
- Define ISMS scope (Clause 4.3)
- Inform risk assessment and treatment
- Create controls (Annex A) that address them
- Monitor compliance and satisfaction over time
