Understanding the needs and expectations of interested parties

Plain-language summary

Listing who has a stake in how you protect information — customers, regulators, employees, suppliers, insurers, owners — what each of them requires of you, and which of those requirements the ISMS will address.

What the clause is really asking

Information security is mostly a promise made to other people, so the clause asks you to name them and write down what they expect. Customers expect their data handled to contract and to law; the Information Regulator expects POPIA's security safeguards and breach notification; a bank customer under the FSCA/PA Joint Standard expects you to meet the security clauses it is obliged to flow down; your cyber-insurer expects the controls you declared on the proposal form; staff expect their personal data protected and clear rules on monitoring. The 2022 edition added a third step: decide which of those requirements the ISMS will take on — not everything an interested party wants is a security requirement, and saying so is allowed. Amendment 1 notes that interested parties can hold climate-related requirements too. The result feeds the legal and contractual requirements register (Annex A control 5.31) and the scope.

What auditors look for

Auditors ask for the list and test it against reality: pick a large customer and ask to see its security requirements; pick a regulation named on the list and ask how it is monitored for change; ask who the POPIA Information Officer is and whether the Regulator appears as an interested party. They probe the 2022 addition directly — 'which of these requirements are inside the ISMS, and how did you decide?' — and they look for the requirements showing up downstream in risks, controls and the SoA justifications. A list of generic party names with 'compliance' written next to each is the classic weak answer.

Typical evidence

Interested-party register with the requirements of each; legal, statutory, regulatory and contractual requirements register (often the same document); customer security schedules and questionnaires on file; a record of which requirements are addressed through the ISMS and which are handled elsewhere; evidence of review when parties or requirements change.

How to comply — recommendations

Build one register with four columns — party, what they require, where it is written (contract clause, section of the Act, policy), and how the ISMS addresses it — and treat it as a living document owned by the ISMS lead. Harvest requirements from real sources: your five largest contracts, your insurer's proposal form, POPIA and its regulations, any sector standard. Mark the requirements you have decided sit outside the ISMS and why. Review the register when a contract is signed, a law changes or an incident involves a third party, and show that review in the management-review minutes.

Common nonconformities

No interested-party analysis, or one that lists names without requirements; regulators (the Information Regulator, sector authorities) missing; customer contractual security requirements not captured anywhere; no decision recorded on which requirements the ISMS addresses; requirements register never updated after new contracts or legislation.

Resources for this clause

• ArticlePOPIA section 19 and ISO 27001: how the standard evidences the law — and why a certificate is not compliance
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Free downloadPOPIA ↔ ISO 27001 CrosswalkTwenty-four POPIA and Regulation 4 duties in plain words, each mapped to the ISO/IEC 27001:2022 clauses and Annex A controls that evidence it — with the GDPR article and NIST CSF 2.0 category alongside, the evidence to show, and a status you mark.
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.