Information Systems Security Architecture Professional (ISSAP) Practice Exam

Understanding who qualifies as a stakeholder rests on recognizing that a stakeholder is someone who has an interest in, or is affected by, the project or system and can influence decisions or outcomes. This includes people or groups such as business sponsors, users, operators, customers, regulators, and the security team—anyone who has requirements, constraints, or responsibilities that shape design, implementation, or operation.

Shadow IT describes unsanctioned technology usage, which is a risk or phenomenon, not a role or group with decision-making power. Vulnerability management is a process for identifying and addressing security weaknesses, not a person or stakeholder. Threat modeling is a method for analyzing threats, not a person or group.

So, the one that fits the concept of a stakeholder is the person or group with a vested interest and influence over the project or system.