Interested parties

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

The organization has to work out which interested parties matter to the ISMS, what those parties require, and which of their requirements the ISMS will deal with. The note says such requirements may include legal, regulatory and contractual obligations. Amendment 1:2024 adds a note that relevant interested parties can have requirements related to climate change (the amendment's wording is held only as quoted in a third-party implementation guide).

How the 2020 guidance taught the audit

Auditors confirm that the organization has a strategic-level understanding of which interested parties matter to the ISMS and of what they need and expect, separating needs it has chosen to take on (agreements, contracts, voluntary codes) from those it cannot avoid because law, regulation, permits, licences, orders or court decisions impose them. Candidate parties range from legal and regulatory bodies at every level, parent organizations, customers, trade and professional bodies, community groups, NGOs, suppliers and neighbours to the organization's own people and information security specialists. Not every expectation becomes a requirement, and some, such as an attacker's wish for weak protection, are opposed by the ISMS through controls. Auditors check whether any relevant interested party has been missed and tell the organization if so, and may check that the understanding gained steers how the ISMS is planned and run.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

No substantive change to the clause. The 2022 text keeps the requirement to determine interested parties and which of their requirements become obligations.

Evidence an auditor asks for

• Interested partiesRegister of interested parties relevant to the ISMS, covering regulators, customers, suppliers, staff and others
• Interested partiesRecord of each party's relevant needs and expectations and of which were adopted as requirements, with the legal, regulatory and contractual sources
• Interested partiesContracts, licences and regulatory instruments that impose information security obligations
• Interested partiesEvidence that the adopted requirements feed the scope, risk criteria and control selection

The questions an auditor will ask

Ask which interested party requirement changed a control or a contract, and where the organisation records its decision.

Common gaps

• Register lists parties but not what each requires
• Mandatory legal and regulatory requirements not separated from voluntary commitments
• A relevant party (for example a sector regulator or key outsourcer) missing from the analysis
• Adversarial parties not considered as a source of risk

Prepare before the next audit

List the interested parties that can affect the ISMS, the requirement each imposes and the internal document that carries it.

Cross-references