Control A.5.31Legal, statutory, regulatory and contractual requirements
Legal, statutory, regulatory and contractual requirements relevant to information security, and the organisation’s approach to meeting them, must be identified, documented and kept up to date.
This is the control that gives clause 4.2’s interested-party requirements an operational home, and for an organisation carrying more than one regime it is the one that stops obligations being tracked in separate places by separate people.
“Kept up to date” is the requirement that decays fastest. A register built once will not survive the arrival of a new regime, the transposition of a directive into national law, or a change of contract with a large customer.
The second half — the organisation’s approach to meeting them — is what makes it more than a list. A register naming an obligation with no statement of how it is met, and by which control, leaves the question open at exactly the point somebody needs the answer. The cross-reference between obligations and controls is also what makes it possible to see where one control is carrying several regimes.
How to put this in place
Laws, regulations and customer contracts can all set security duties. Missing one is easy unless somebody keeps the list.
- Identify the laws, regulations and contract requirements that apply to your activities.
- Record what each requires of you in a register.
- Name an owner and the controls that address each.
- Include security schedules from customer contracts.
- Review the register at least every 12 months and when a law or major contract changes.
Evidence an auditor usually looks for: the requirements register with owners and review dates, and examples of requirements traced to controls.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists register of legal, statutory, regulatory and contractual requirements among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.