ISO 27001: Understanding the needs and expectations of interested parties

There are many complexities in the ISO 27001 standard and part of it is being able to recognise what your aims are as an organisation, who you rely on and who relies on you; more concisely described as “recognising the needs and expectations of interested parties”. As expert ISO 27001 consultants, we often find that when we are supporting clients through the implementation of ISO 27001, there is some confusion around the importance of understanding the needs and expectations of interested parties and also how you go about identifying and meeting them.

From our experience, it is typically looked upon as something you ‘just have to do’ but in reality, understanding your interested parties will help you to not only satisfy their requirements but also make more educated strategic decisions over time. In this blog, we are going to explore interested parties and how you, as a business, go about identifying the needs and expectations of each, what they are reliant on you for and also you of them.

Who are ‘interested parties’?

First of all, it is key to understand who the ‘interested parties’ are. Interested parties, through the eyes of ISO 27001, are stakeholders who can influence your information security and business continuity or be affected by your processes or activities. Stakeholders can be either internal or external to your organisation meaning that all should be considered. Some examples of internal and external stakeholders are listed below:

Internal Stakeholders

• Employees
• Apprentices
• Senior Management
• Directors
• Company Board

External Stakeholders

• Customers / Clients
• Partners / Suppliers
• Legal & Regulatory Bodies
• Providers of Professional Services
• Technology Providers (e.g. SaaS, PaaS and IaaS)
• Special Interest Groups (e.g. NCSC)
• Physical Security / Utility Providers

Why is understanding the needs and expectations of interested parties important?

It would be very easy to suggest that we must identify needs and expectations simply because ISO 27001 requires it, but let’s understand why.

Organisations need to identify all stakeholders, internal and external because each one has their own part to play and their own responsibilities when it comes to information security. If we take customers/clients as an example, they will have a surface-level expectation of you to deliver your products/services and meet their requirements. However, their expectations will go much deeper than just delivery.

Regardless of what you do as a business, your customers will want to be able to maintain confidence that you are keeping their information secure. This is where identifying needs and expectations comes into play. By identifying the needs and expectations of all interested parties, you are recognising, analysing, and ultimately understanding what their requirements are of you from an information security perspective, why they have these expectations of you, and also how you are going to meet them.

What happens if you don’t take into account interested parties’ needs?

Failing to understand the needs of your customers and clients can prevent you from adequately addressing their information security requirements and meeting their expectations. For instance, if you overlook how to fulfill these security needs and a breach of sensitive information occurs, the consequences could be severely damaging to your organisation.

In addition, the needs and expectations of parties such as regulatory bodies and clients will play a big part in the risk appetite of the organisation.

If you tolerate high levels of risk, you may fail to meet the expectations of those identified parties which could result in enforcement actions from regulatory bodies or customers taking their business to competitors. This is why needs and expectations are so important as they are essentially an input into larger considerations such as risk appetite.

It is important to note that this is not just applicable to customers or clients alone. This approach should be applied to all of your identified interested parties.

How do we identify needs and expectations? 

As previously noted, not all interested parties are going to have the same expectations of you as a business. These expectations can vary however the approach you use in which to identify them should remain the same to ensure and promote consistency in your methods.

The first step to identifying the needs and expectations of each interested party would be taking a look at their areas of interest within the organisation. For example, Directors and members of the company board are going to be interested in the company mission, vision, and success, upholding ethical standards and ensuring effective governance. Employees, for example, will be interested in things such as company culture, training and development, recognition and rewards and personal security.

When it comes to identifying requirements of external stakeholders, there are plenty of resources available to aid you with this. If we take legal and regulatory bodies for example, there are published legislations that detail exactly what an organisation will need to comply with, and it is then up to you to ensure that you do so.

From here, you need to work out what you do or are going to do, to meet those requirements and document them.

Below are some examples of how an organisation may wish to identify needs and expectations:

• Conducting stakeholder analysis
• Interviewing stakeholders
• Reviewing contracts and agreements
• Monitoring feedback and complaints

What does ISO 27001 require?

If we turn our attention to the ISO 27001 standard, clause 4.2 focuses on understanding the needs and expectations of interested parties. Within this specific clause, there are four points listed:

• Determining relevant interested parties.
• Determining the requirements of identified interested parties.
• Determining which requirements are to be addressed through the Information Security Management System (ISMS);
• Determining how these requirements will be met.

If we break these points down into their fundamentals, the first point addresses the ‘who’, the second point addresses the ‘what’ and the third and fourth points address the ‘how’. Once you can see it from this perspective, understanding the needs and expectations of interested parties is simply identifying the ‘who’, the ‘what’ and the ‘how’ through the implementation of your ISMS.

As you continue to grow as a business, your interested parties will continue to expand and, as such, you will be expected to constantly review who your interested parties are, what they expect of you and how you intend to meet their expectations. In doing this, you are understanding your responsibilities for information security and committing to the continual improvement and development of your ISMS.

Conclusion

Every organisation seeking certification to ISO 27001 will be required to ensure that they are delivering what is required from their internal and external stakeholders. By being able to identify who your interested parties are, what they require of you, and how you plan to address them, you are ticking all of the required boxes and complying to clause 4.2 of ISO 27001 which is understanding the needs and expectations of interested parties.

Need help with ISO 27001 consultancy?

If you need a benchmark assessment or a full ISMS implementation, we can help. Our experienced ISO 27001 consultants can get you certified and help you to remain compliant. View our ISO consultancy solutions here. Or if you’d like to understand more about the costs of ISO consultancy, you may find this article helpful: Guide to understanding ISO consultancy costs.

Already have ISO 27001 certification but need to upgrade to the new ISO 27001:2022 standard? We have supported several clients smoothly through this upgrade.