How do we decide which issues and interested parties' requirements our ISMS has to address?

Start

We must record what shapes our ISMS and who expects what

The auditor expects the ISMS to reflect the organisation's real situation: what is going on around it and what other people need from it. The record is short, but it must be yours, dated and owned, and it must visibly change the scope and the risk work.

• Then: Start from the services in the draft scope

Step

Start from the services in the draft scope

An issue or a party matters to the ISMS only through the services in scope. Take each service and ask what could affect it. Working from the draft scope keeps the list short and stops a general risk survey.

• Then: List the internal and external issues, with leaders

Step

List the internal and external issues, with leaders

Cover regulation, customers, technology, suppliers, structure and people. Ask the leaders who run the services, not only the security team, because they know what is changing. One line per issue and its effect on the ISMS is enough.

• Then: List the parties who expect something of your security

Step

List the parties who expect something of your security

Typical parties are customers, regulators, insurers, staff and suppliers, as the management review pack lists them. Name the party and what it expects. Leave out those that have no bearing on information security.

• Then: Does this party require something of information security?

Decision

Does this party require something of information security?

Take the parties one at a time. Ask what it requires: a contract clause, a law, a questionnaire it sends, a certificate it asks for. If you are unsure, answer yes and check. Answer no only when you are sure none exists. A broad party such as society at large seldom passes.

• Yes, or not known: Is the requirement a law, a regulation or a contract term?
• No: Leave it out, and note why in one line

Step

Leave it out, and note why in one line

A short note that you considered the party and found no requirement shows judgement. Padding the list with parties that require nothing makes it harder to keep current and invites the question of what you did with each.

• Then: Is there another party to check?

Decision

Is the requirement a law, a regulation or a contract term?

Legal and contractual duties bind you and cannot be declined. Expectations, such as a customer's wish or an industry norm, are a choice. Keep the two apart so the ISMS can say which it must meet and which it has chosen to.

• Yes, or not known: Record it as binding and pass it to the legal register
• No: Will the ISMS meet this expectation?

Step

Record it as binding and pass it to the legal register

These go to the register of legal, regulatory and contractual requirements. They also shape the scope, the risks and the controls, and a control a law or contract requires stays applicable in the Statement of Applicability.

• Then: Link it to a control, a process or an objective

Decision

Will the ISMS meet this expectation?

Decide, with the owner of the relationship, whether to meet it. Meeting it means it is linked to a control, a process or an objective. Declining is legitimate if you can say why, for example that it falls outside the scope.

• Yes: Link it to a control, a process or an objective
• No: Record the decision and the reason for declining

Step

Record the decision and the reason for declining

An expectation you chose not to meet is still a recorded decision. The reason keeps the list honest and lets you reopen the choice when the party's position changes.

• Then: Is there another party to check?

Step

Link it to a control, a process or an objective

The link is what turns a note into an input to the ISMS. Name where the requirement is met: the scope, a control in the Statement of Applicability, a process or an objective. Give each requirement a person who tells you when it changes.

• Then: Is there another party to check?

Decision

Is there another party to check?

Go round again until every party that came to mind has been checked. A review later will add more as customers and contracts change.

• Yes: Does this party require something of information security? (back to an earlier step)
• No: Has the organisation decided whether climate change is relevant?

Decision

Has the organisation decided whether climate change is relevant?

Amendment 1:2024 asks the organisation to determine whether climate change is a relevant issue, and notes that interested parties can have climate-related requirements. The duty is to make and record the determination. It is not a duty to act on climate. If the decision was never made, answer no. Certification bodies now ask to see this determination.

• Yes: Write the result in one short record with an owner and a date
• No, or not known: Decide with top management and record it either way

Step

Decide with top management and record it either way

Ask whether climate events could affect a site, a supplier or the services you deliver, or whether a customer or regulator asks for something on it. Record yes or no, the reason, and any climate-related requirement a party has. These examples are prompts, not a checklist. If a party has a climate-related requirement, add it to the list and test it as you did the others, as binding or as an expectation.

• Then: Write the result in one short record with an owner and a date

Step

Write the result in one short record with an owner and a date

One dated record for the issues and one for the parties is enough, in a table or a page of the ISMS manual. The pack's checklist lists no separate document for these clauses, but the auditor samples them and the management review reads them as inputs.

• Then: Can you show how the list shaped the scope and the risks?

Decision

Can you show how the list shaped the scope and the risks?

The auditor's usual challenge is how the issues and parties shaped the scope and the risk assessment. Show one or two traces: a requirement that widened the scope, an issue that created a risk. If you cannot, answer no.

• Yes: Have you decided what to tell each party, when, how and by whom?
• No, or not known: Add the link: which scope line or risk each item changed

Step

Add the link: which scope line or risk each item changed

Go through the list and note, against each item, the scope line, risk, control or objective it affected. Items with no effect are candidates to drop.

• Then: Have you decided what to tell each party, when, how and by whom?

Decision

Have you decided what to tell each party, when, how and by whom?

Clause 7.4 asks you to decide what to communicate about information security, when, with whom and how, inside and outside the organisation. The 2022 wording does not name who speaks, but an auditor will ask. Public guides say it needs no separate document, but an auditor checks that the parties, content, timing and channels are defined. If you have not decided, answer no.

• Yes: Set when the list is reviewed and who reports changes
• No, or not known: Write a short plan: what, when, how and who, inside and outside

Step

Write a short plan: what, when, how and who, inside and outside

For each party on your list and for staff, note what they are told, when, by which channel and who speaks. Reuse what exists: the incident message set already names who may speak for the organisation, and the awareness plan covers staff. One page or a table is enough.

• Then: Set when the list is reviewed and who reports changes

Step

Set when the list is reviewed and who reports changes

The management review considers changes in issues and in what interested parties need. Ask the legal and contract owners to report changes to you, and review the list at least as often as the management review (the pack's default is every 12 months) and after a major change in your services.

• Then: Issues and requirements recorded: take them into the risk work

Outcome

Issues and requirements recorded: take them into the risk work

Take the list to the next step, where it feeds the risks and opportunities to the ISMS and the risk assessment. Do not describe the record as proof that you comply with any law. It records what you decided to address.