Identify information needs

What the published 2016 guidance says

Information needs are the starting point. They come from interested parties, strategy, policy, objectives and the risk treatment plan, and they describe what the organization must understand about its operations or performance. The guidance suggests examining the management system and its parts, then ranking the needs by risk priority, capability, resources, stakeholder demands, legal and contractual duties, and the value of the information against the cost of measuring it. A subset is selected, documented and shared with the people who will use it.

What it means in practice

Information needs come from interested parties, strategy, policy, objectives and the risk treatment plan. Prioritise them, choose the subset worth measuring, and publish the list. A need that is never written down cannot be traced to a measure, and a measure with no need behind it cannot be defended in a budget review.

What good looks like

Publish the information-needs list with a priority and an owner. Record why each need was selected or deferred. Review the list when strategy, law or the risk treatment plan changes.

Evidence an assessor asks for

• Performance evaluationA prioritised, documented list of information needs with the criteria applied
• PlanningEvidence the selected needs were communicated to interested parties
• Performance evaluationTraceability from information needs to the policy, objectives, obligations and risk outcomes

The question an assessor will ask

An assessor will ask for A prioritised, documented list of information needs with the criteria applied. The test for 8.2 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.

Common gaps

• Information needs never written down, so measures cannot be traced to them
• No prioritisation, so measurement effort spreads across everything and covers nothing well
• Selected needs known only to the measurement planner

Before the next review

Before the next review, test this against one live record: information needs never written down, so measures cannot be traced to them.

What to check when the revision publishes

When DIS 27004 is published, compare the 8.2 Identify information needs record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.