Interested parties
Last checked on
Interested parties records who, besides your own organisation, has a stake in how you handle information: customers, regulators, suppliers, employees and others. For each party you note what they expect and whether and how you deal with it.
Why this protects your organisation
A large customer may require you to report incidents within 24 hours; your data protection authority expects you to report a breach on time; your staff expect their own data to be safe. If you do not know these expectations, you find out about them when it is too late, often in a contract dispute or a lost tender. ISO 27001 clause 4.2 expects you to know who these parties are and what they need from you, and to choose which of those needs your management system takes on.
Steps
- Open Interested parties in the Organisation group.
- Click New Interested party.
- Choose the Kind (Customer, Regulator, Supplier, Employee or Other) and enter the Name, then click Create.
- On the party's page, add each expectation under What they expect.
- Describe the expectation, switch on Picked up by the management system if you address it, explain How, and link a Document if one covers it.
The list shows each party's Name, its Kind and how many Requirements you recorded for it.
Who to include
Think about who could hold you to account. For most software companies that includes the customers with the strictest contracts, the regulator for personal data, a works council if you have one, the suppliers you depend on, and your own staff. Name a party as specifically as helps you. A single important customer may deserve its own entry, while smaller customers can share one.
Expectations
Per party you record what they expect, in their terms or your own words. Picked up by the management system says whether you have decided to address it. How describes what you do about it, for example a clause in your incident procedure. Document links the document where that is written down, so an auditor can follow the line from expectation to evidence.
An expectation you do not pick up is still worth recording: it shows you considered it.
If it does not work
The Document list is empty
You can only link documents that exist in the Documents screen. Create the policy or procedure there first.
Saving an expectation fails
What they expect is required. How and Document are optional.
I do not see New Interested party or cannot add expectations
These actions require edit rights for the Organisation module. Owners and members have them; an advisor only when the workspace owner has granted them. Only owners and members can delete a party or an expectation.
Screens this is about
- Interested parties