Needs and expectations of interested parties
Keep a register of who has a stake in continuity and what each of them actually requires, including the legal and regulatory obligations that attach to keeping services running.
01What applies
Establish who holds a stake in the organization's continuity and what each party requires of it. Cover stated expectations and the legal and regulatory obligations tied to keeping products and services going. The clause makes a distinction the register must keep: an expectation is not an obligation, and an obligation is not automatically a continuity requirement until it is read against what the organization does. The register is maintained, not produced once. A party with no requirement recorded against it is a name, not an interested party.
02Why it matters
Most continuity failures are discovered by a party the organization forgot to ask. A customer with a contractual recovery time, a regulator with a notification window, an insurer with a condition, an emergency service that expects a named contact: each changes what the BCMS has to deliver. The clause turns those into explicit requirements so the impact analysis and the plans can be tested against them. It also stops the legal register from sitting with the legal team, disconnected from the continuity work.
03What good looks like
Build the register in three columns: party, requirement, and the clause or contract that creates it. Split legal obligations into those that constrain continuity directly (notification, service levels, safety) and those that only shape the record. Give each requirement an owner and a review date. Ask customers for the continuity clause in their contract, not for their opinion.
04Evidence an auditor asks for
Pick two customers at random and ask for the continuity requirement in their contract. If it is not in the register, the register is incomplete.
| Evidence | The record |
|---|---|
| Interested party register | Register with a requirement recorded against every party, each with its source |
| Legal register | Applicable continuity-related legal and regulatory obligations, mapped to the activity they constrain |
| Maintenance record | Evidence both registers are reviewed, not one-time artefacts |
05Where it commonly fails
- Stakeholder list with no requirement recorded against any entry
- Legal obligations left with the legal team and never connected to continuity planning
- Customers under contractual continuity terms, or emergency services, missing from the register
06What to do before the estimate
Pull the continuity and service credit clauses from the top ten customer contracts. Add one row per clause to the register, with the contract reference.