Key takeaways
- List the people and groups who care about your security (customers, regulators, staff, suppliers) and what they need from you, and which needs you'll address.
- Customers, regulators, staff and suppliers all expect things from you.
- Start here: list interested parties relevant to information security.
Purpose
List the people and groups who care about your security (customers, regulators, staff, suppliers) and what they need from you, and which needs you'll address.
Requirement
Requirement summaryThe organization shall determine: a) interested parties that are relevant to the information security management system; b) the relevant requirements of these interested parties; c) which of these requirements will be addressed through the information security management system.
Why it matters
Customers, regulators, staff and suppliers all expect things from you. Knowing those expectations shapes scope, risks and objectives.
How to implement
- List interested parties relevant to information security.
- Record what each needs or expects, such as contract terms or legal duties.
- Decide which requirements the ISMS will address.
- Set up a way to monitor changes and review the register regularly.
What evidence you need to provide
Here is what you will typically need to provide for Clause 4.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- A list of your interested parties (customers, staff, regulators, suppliers, investors) and what each one expects from you on security.
Records and examples to show
- Evidence of where these expectations came from, such as contracts, customer security questionnaires or laws.
- Proof the list is reviewed regularly.
- A note of which expectations you have decided to meet through your security programme.
Things you should be able to show or explain
- Be able to explain how a customer requirement turned into something you do.
How much to show: The full list and two or three examples.
Common mistakes
- Key parties missing, such as major customers.
- Expectations listed but not acted on.
- Listing parties without their requirements.
- Forgetting internal parties such as employees and the board.
- Tip: Keep your scope tight for your first certification — you can always expand it later.
Policies & documents to have
- ISMS scope statement
FAQ
Can we exclude clause 4.2?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Relevant parties identified, their requirements captured and linked to the ISMS.