Stakeholder analysis: template, matrix and worked example

The customer expects security evidence before renewing a contract. Executives want to know which resources are missing. Employees need procedures that work in practice. They are discussing the same ISMS, but they expect different results.

A stakeholder analysis helps you clarify those expectations early. Who is affected? Which requirements are binding? Who decides, who does the work and who needs to be involved? Use the stakeholder analysis template for Excel to organise expectations, assign owners and plan next steps. The worked example shows how to apply it in an ISMS.

What is a stakeholder analysis?

A stakeholder analysis identifies people, groups and organisations that influence an initiative or are affected by its outcomes. It describes their interests and helps plan collaboration and communication. The Association for Project Management considers factors including influence, interest and support for an initiative.

By the end, you know what each relevant party needs and how you will respond. In project management this might concern a new application. In an ISMS it might involve security commitments to customers, leadership decisions or requirements for service providers.

Distinguish requesters and delivery owners: the customer needs the evidence; the ISMS lead prepares it. That makes clear who expects something and who delivers it.

1. Define the context

Start with a sentence: “We are assessing the introduction of an ISMS for our customer portal operations.” This is more precise than “company stakeholders” and makes relevant parties easier to identify.

Speak to colleagues who understand contracts, operations, people and security work. Consider:

• Customers: Which security commitments, audit rights or reporting obligations have you agreed?
• Executives: Which budget, risk and priority decisions are pending?
• Employees: Who will use new procedures, and who understands the obstacles in daily work?
• Service providers: Who delivers critical services and needs to contribute during changes or incidents?
• Authorities and other bodies: Which responsibilities and obligations need checking for your specific operations?

Record roles or groups when identifying an individual is unnecessary. “IT operations” will usually remain accurate longer than a temporary contact's name. Record relationship owners separately.

For critical providers, a vendor assessment complements the analysis. Your business impact analysis can help identify important services. This also identifies the external parties you need for ongoing operations and recovery. Our BIA guide and workbook are currently available in German.

2. Create a stakeholder matrix: assess influence and interest

An influence–interest matrix helps you decide how closely to involve each party. The template uses two scores from 1 to 5:

• Influence: How strongly can this party affect decisions, resources or the course of this initiative?
• Interest: How affected or engaged are they in its outcome?

Record a concrete reason: “Approves the budget” or “Uses the new process every day”. Discuss uncertain assessments with the people involved.

The Excel matrix automatically counts stakeholders in each cell. The register shows their names and suggested engagement approach. The template treats scores 1–2 as low and 3–5 as high.

Involve the people who will work with the result. Employees may not control the budget, but they know the obstacles in daily work. Their feedback helps develop workable procedures. The APM communication planning guide explains why influence alone is insufficient when planning engagement.

3. Turn expectations into verifiable requirements

“The customer wants security” does not give your team a clear task. “The customer receives the agreed security report before renewal” can be assigned and checked.

Record each requirement separately. One party can have several. The template links them through a stable stakeholder ID and distinguishes three classifications:

Assess binding requirements against their sources, independently of matrix scores. Where contractual or legal requirements are unclear, the responsible specialist establishes what applies.

In an ISMS, these stakeholders are also called interested parties. Record which requirements you address in the ISMS, how you implement them and how you establish fulfilment. The ISO 27001 checklist guides you through the remaining certification preparation steps.

Worked example: a customer needs a security report

An IT service provider is introducing an ISMS. Customer North needs the agreed security report before renewing its contract. Operations and the ISMS lead hold the evidence. The account owner still needs to clarify the scope the customer expects.

Here is how to work through the case in the template:

After the call, the scope, recipient and deadline are agreed. The ISMS lead can now prepare the report. Once it is delivered, they add evidence to the requirement. You can track both steps: agreeing expectations with the customer and delivering the report.

4. Agree communication and delivery

For each next step, establish who, with whom, for what purpose, through which channel and by when. Prepare the decision executives need to make: which resources are missing, and what are the options? Give employees an opportunity to ask questions about new procedures.

For a new security policy, the people team could discuss a draft with affected teams, collect questions and bring open issues into approval. Our guide to introducing a new policy version explains how versioning, approval and acknowledgement connect.

Record the result afterwards. Did the conversation clarify scope? Was a decision made? Which question remains open? A recorded outcome lets the next person pick up the work directly.

5. Keep the analysis current

Assessments change: a small customer becomes your main customer, a provider takes on additional work or a contract introduces new security commitments. Reassess the affected entries when those changes occur.

The ONS stakeholder mapping guide recommends regular reviews and engagement suited to the initiative. Agree a next review date and additional triggers. Set the template’s reference date to the date of your meeting to see which reviews are due by then.

Unresolved expectations, missing resources and conflicting requirements belong with the appropriate decision-maker. You can bring leadership decisions together in the ISMS management review. Reference the specific entries and state the decision needed.

When should you move from Excel to Kopexa?

The template helps you build your first analysis together. Maintaining it becomes more involved when the same customer appears across several risks, actions and programmes. Changes then need to be tracked in multiple places.

In Kopexa, you can maintain stakeholders as individual records and link them to risks, actions, programmes and objectives. You can see which security work relates to a customer or provider and who owns delivery. Our stakeholder and objectives product update provides an overview.

A one-off stakeholder analysis becomes ongoing stakeholder management: your team keeps working on the linked risks, actions and objectives. Our ISMS software brings that work together.