Control A.5.31Legal, statutory, regulatory and contractual requirements
What it means in practice
Legal, statutory, regulatory and contractual requirements relevant to information security, and the organisation’s approach to meeting them, must be identified, documented and kept up to date.
This is the control that gives clause 4.2’s interested-party requirements an operational home, and for an organisation carrying more than one regime it is the one that stops obligations being tracked in separate places by separate people.
“Kept up to date” is the requirement that decays fastest. A register built once will not survive the arrival of a new regime, the transposition of a directive into national law, or a change of contract with a large customer.
The second half — the organisation’s approach to meeting them — is what makes it more than a list. A register naming an obligation with no statement of how it is met, and by which control, leaves the question open at exactly the point somebody needs the answer. The cross-reference between obligations and controls is also what makes it possible to see where one control is carrying several regimes.
How to put this in place
Laws, regulations and customer contracts can all set security duties. Missing one is easy unless somebody keeps the list.
- Identify the laws, regulations and contract requirements that apply to your activities.
- Record what each requires of you in a register.
- Name an owner and the controls that address each.
- Include security schedules from customer contracts.
- Review the register at least every 12 months and when a law or major contract changes.
Evidence an auditor usually looks for: the requirements register with owners and review dates, and examples of requirements traced to controls.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Mandatory ISMS Documentation Checklist
in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists register of legal, statutory, regulatory and contractual requirements among the documents auditors commonly expect for this control. - Word
Stage 1 and Stage 2 Audit Preparation Guide
in ISO 27001 Implementation & Certification ReadinessListed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge. - Excel
NIS2 Scope & Entity Classification Assessment
in NIS2 Implementation & ReadinessIts Framework References list this control. Supported by: The whole workbook: NIS2 identified as a legal requirement, and how it applies, recorded. - Excel
NIS2 Article 21 Measure-to-Control Mapping Library
in NIS2 Implementation & ReadinessIts Framework References list this control. Supported by: The whole library: the legal requirements of Article 21 identified and recorded, each with an owner. - Excel
EU Incident Notification Timeline Matrix (NIS2, DORA, GDPR)
in Regulatory Incident Notification & ReportingIts Framework References list this control. Supported by: The matrix as a whole: each legal and regulatory reporting requirement, with its trigger, deadline and content. - Word
Reportability Decision Model
in Regulatory Incident Notification & ReportingIts Framework References list this control. Supported by: The applicability profile and the three legal tests. - Excel
US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)
in Regulatory Incident Notification & ReportingIts Framework References list this control. Supported by: The matrix as a whole: each legal and regulatory reporting requirement, with its trigger, deadline and content. - Excel
Unified Control Framework Mapping Workbook
in Security Control AssuranceIts Framework References list this control. Supported by: NIS2 Article 21(2), ISO 27001 Annex A, NIST CSF 2.0 and DORA Chapter II sheets, and the contracts column: the requirement sets you answer for, identified and recorded. - Excel
DORA Proportionality & Scope Assessment
in DORA ICT Risk & Resilience ReadinessIts Framework References list this control. Supported by: The whole workbook: the legal requirements that apply to the entity, identified and recorded. - Excel
DORA Article-to-Control Mapping Library
in DORA ICT Risk & Resilience ReadinessIts Framework References list this control. Supported by: The whole library: the legal and regulatory requirements that apply to the entity identified and recorded, each with an owner. - Excel
EU AI Act Role & Risk Classification Worksheet
in AI Security Governance & Acceptable UseIts Framework References list this control. Supported by: The whole workbook: the legal and contractual requirements of the AI Act, read and recorded for each use. - Excel
HIPAA Applicability Assessment
in HIPAA Security Rule ReadinessIts Framework References list this control. Supported by: The whole workbook: the legal requirement identified, its role decided and the decision recorded.