How do we build a register of legal, regulatory and contractual requirements that stands up to an ISO 27001 audit?

Start

We need a register of legal, regulatory and contractual requirements

The control asks you to know which laws, regulations and contracts set security duties on you, and to keep that knowledge current. Auditors sample the register, and it shapes the scope, the risks and the controls, so build it before the risk assessment, not after.

• Then: Start from the scope: countries, sectors, data and services

Step

Start from the scope: countries, sectors, data and services

The pack lists legal, regulatory and contractual requirements as an input to gather in Phase 1, because they shape the scope, the risks and the controls. Write down where you operate, which sectors you serve, what data you hold and which services you deliver.

• Then: List the laws and regulations that touch those

Step

List the laws and regulations that touch those

Think of data protection and breach notification laws, sector rules and, depending on where you are, EU rules such as NIS2 or DORA, or US state privacy laws and sector rules such as HIPAA. These are prompts. Your scope decides the list.

• Then: Has counsel or compliance settled which of them apply to you?

Decision

Has counsel or compliance settled which of them apply to you?

Applicability is often a legal judgement, for example size thresholds or sector tests. Do not settle it by reading a summary. If you are not sure, answer no.

• Yes: Read the security schedules in your customer contracts
• No, or not known: Ask legal counsel to confirm which apply

Step

Ask legal counsel to confirm which apply

Give counsel the scope, the services and the data. Record the conclusion and the date in the register. The register holds your decision, not the advice.

• Then: Read the security schedules in your customer contracts

Step

Read the security schedules in your customer contracts

Start with the largest customers and those who audit you. The control guidance names customer contract security schedules missing from the register as a frequent gap. Note notification times, audit rights, certificates and data handling terms.

• Then: Add other binding duties you have accepted

Step

Add other binding duties you have accepted

These include insurer terms and standards you have agreed to meet by contract, such as payment card rules. Include a duty only if you are bound to it.

• Then: Write what each one requires of you, in a sentence

Step

Write what each one requires of you, in a sentence

Listing laws without saying what they require of you is a gap auditors reliably find. State the duty in plain words: report a breach within a period, keep records for a period, restrict transfers.

• Then: Name an owner and the control or record that meets it

Step

Name an owner and the control or record that meets it

The owner keeps the entry current and answers the auditor on it. Name legal or compliance with the ISMS manager for the register as a whole, and a control owner for each duty.

• Then: Can you point to the control or record that meets each one?

Decision

Can you point to the control or record that meets each one?

Take a sample of entries and follow them to the control, policy or record that meets them. If you cannot, the entry is a title, not a duty. If you are not sure, answer no.

• Yes: Do several regimes set duties on the same control?
• No, or not known: Log the gap with an owner and a date

Step

Log the gap with an owner and a date

Add it to your gap tracker. Do not exclude a control because it is missing: a control a law or contract requires stays applicable in the Statement of Applicability.

• Then: Do several regimes set duties on the same control?

Decision

Do several regimes set duties on the same control?

If, for example, a breach must be notified under more than one regime, design the control to the strictest requirement and keep evidence for each. If you are not sure, answer yes.

• Yes, or not known: Handle the overlap in your control design
• No: Set how changes reach the register, and when it is reviewed

Step

Handle the overlap in your control design

Follow the multi-regime question. Never drop one obligation to make the set smaller.

• Then: Set how changes reach the register, and when it is reviewed

Step

Set how changes reach the register, and when it is reviewed

Ask legal and contract owners to report new laws and changed contracts. Route every new customer security schedule through the register. Review it at least yearly and when a law or major contract changes, as the control guidance suggests.

• Then: Is the register approved and under document control?

Decision

Is the register approved and under document control?

The checklist's pass test is that the item exists, is approved and is under document control. If it is a draft or has no owner, answer no.

• Yes: Register in place: owned, traced and kept current
• No, or not known: Have the owner approve it and put it under document control

Step

Have the owner approve it and put it under document control

Give it a version, a place where the right people find it and a review date. Then include its latest review in the management review pack as a change to requirements.

• Then: Register in place: owned, traced and kept current

Outcome

Register in place: owned, traced and kept current

The register shows what binds you and how you meet it. Do not describe it, or an ISO 27001 certificate, as proof that you comply with any law. A supervisor may expect documents this register does not list.