Legal, statutory, regulatory and contractual requirements
Purpose
Identify, document and keep current the legal, statutory, regulatory and contractual requirements relevant to information security.
How to meet this control
In short: Identify and meet relevant legal and contractual security obligations.
- Step 01Maintain a compliance obligations register covering privacy law (the Privacy Act and Australian Privacy Principles), GDPR where relevant, PCI DSS and contractual duties
- Step 02Map each obligation to the controls and owners that satisfy it
- Step 03Account for cross-border data transfer and any foreign laws that apply to your data
- Step 04Address cryptography import, export and usage restrictions with legal advice where relevant
- Step 05Review the register regularly and scan for new or changed legislation, updating controls accordingly
Tip: Keep a compliance obligations register (privacy laws, contracts, PCI, etc.).
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Factor external requirements into security policies, controls and risk treatment activities
- ›Identify all legislation and regulations relevant to your type of business
- ›Consider compliance in every country where you operate or whose products and services you use
- ›Account for cross-border data transfers where foreign laws may apply
- ›Review identified laws regularly and spot new legislation as it emerges
- ›Address specific cryptography rules such as import, export and usage restrictions, seeking legal advice
- ›Reflect security requirements in contracts with clients, suppliers and insurers
- ›Define documented processes and assign responsibilities for meeting these requirements
Audit evidence to keep
- - Compliance obligations register listing applicable laws, regulations and contracts
- - Mapping of obligations to the controls and owners that meet them
- - Evidence of periodic review and updates for new legislation
- - Records addressing cross-border transfer and cryptography restrictions where relevant
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.5.31. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.