#iso27001/2022/EN
# 4.2 Understanding the needs and expectations of interested parties

The organization shall determine:

a\) interested parties that are relevant to the information security management system;

b\) the relevant requirements of these interested parties;

c\) which of these requirements will be addressed through the information security management system.

NOTE The requirements of interested parties can include legal and regulatory requirements and contractual obligations.
