Key takeaways
- Identify and meet the legal and contractual requirements that apply to you.
- Laws, regulations and contracts create security obligations you must know and meet.
- Start here: build a register of relevant legal, regulatory and contractual requirements.
Purpose
Identify and meet the legal and contractual requirements that apply to you.
Requirement
Requirement summaryLegal, statutory, regulatory and contractual requirements relevant to information security and the organization’s approach to meet these requirements shall be identified, documented and kept up to date.
Why it matters
Laws, regulations and contracts create security obligations you must know and meet.
How to implement
- Build a register of relevant legal, regulatory and contractual requirements.
- Assign an owner to track changes.
- Map each requirement to the controls that satisfy it.
- Review the register at least yearly.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.31. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- A list of the laws, regulations and contract requirements that apply to you, each with an owner.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.31 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Proof the list is reviewed regularly.
- Examples linking a requirement to the control that meets it.
Things you should be able to show or explain
- Be able to explain how you find out about new legal requirements.
How much to show: Three to five requirements.
Common mistakes
- List incomplete or out of date.
- Requirements with no owner.
- Overlooking customer contract security clauses.
- A register that lists laws but not what they require.
- Tip: Maintain a legal register with owners and review dates.
Policies & documents to have
- Legal, regulatory and contractual requirements register
FAQ
Is A.5.31 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.31?
Be ready to explain how the control works in your organisation and to provide things like: A list of the laws, regulations and contract requirements that apply to you, each with an owner…