A.5.31
Legal, statutory, regulatory and contractual requirements
Organizational controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control requires the organization to identify and document, without omission, all legal, statutory, regulatory, and contractual requirements relevant to its information security and privacy, and to define and keep current its approach to meeting them. It calls for understanding the obligations that apply across every jurisdiction in which the organization operates (domestic and foreign), and for defining the processes and responsibilities for meeting each requirement. Linking requirements to owners, assets, and controls is a practical way to keep compliance verifiable on an ongoing basis. The ultimate aim is to prevent penalties, fines, and suspension arising from legal violations, and damages and loss of trust arising from contractual breach, while feeding regulatory requirements into the management system and risk assessment as inputs.
Key checkpoints
- Are legal, statutory, regulatory, and contractual requirements relevant to information security and privacy identified per jurisdiction, documented as a register, and kept current?
- For each requirement, are a responsible owner and the control/procedure that satisfies it mapped, and is compliance verified periodically?
- Is there a process to monitor changes such as new or amended laws, new regulations, and contract changes, and to reflect them in the register and controls?
- Are the national legal restrictions on the adoption, import/export, and use of cryptographic technology reviewed and complied with?
- Are the legal requirements that apply to cross-border data transfers, including transfers of personal data abroad, identified and addressed?
- Are the security and privacy requirements contained in customer/supplier contracts identified and translated into actual implementation and evidence?
Implementation guidance
- Build a compliance requirements register that lists each legal, statutory, regulatory, and contractual requirement relevant to information security and privacy, recording for each the jurisdiction, source clause, owner, responding control, and compliance status.
- Determine the obligations of every country/region in which the organization does business, and for multinational operations, distinguish and manage requirements that conflict or are additional across jurisdictions.
- Operate a mechanism to continuously monitor new and amended laws and regulatory trends (legal/compliance function, legal counsel, subscriptions to regulator notices), and reflect changes in the register and in risk assessment/controls.
- Review national regulations on the use, adoption, and import/export of cryptographic technology (licensing, notification, algorithm restrictions), and comply with them in conjunction with cryptography controls (A.8.24).
- Identify requirements that apply to specific domains such as cross-border transfer of personal data, data localization, and electronic transactions/e-finance, and reflect them in the relevant procedures and contracts.
- Identify security/privacy clauses in customer and supplier contracts, with implementation owners and evidence methods. At contract termination, identify surviving duties such as confidentiality, record retention, and return/disposal, and track each until it ends.
- Periodically review the consistency between the compliance requirements register and the responding controls, and manage significant non-compliance risks through management reporting and improvement items.
Evidence
- Register of legal/statutory/regulatory/contractual requirements relevant to information security and privacy (including jurisdiction, source clause, owner, responding control, compliance status)
- Records of legal monitoring/regulatory trend review and the register's update history
- Legal requirements compliance review reports and records of corrective action for non-compliance
- Review material on legal restrictions relating to the use and import/export of cryptographic technology
- Basis for legal review/action on cross-border data transfers such as transfer of personal data abroad
- Security/privacy requirement clauses in customer/supplier contracts and the related implementation/evidence
Nonconformity examples
- No register of applicable legal/regulatory/contractual requirements exists, or it has not been updated for years so current legislation is not reflected.
- Requirements are listed but no responsible owner or satisfying control is mapped, so compliance cannot be verified.
- New or amended regulations (for example, amendments to privacy legislation) are not monitored and so are not reflected in the management system.
- Foreign business/services are operated without identifying the legal requirements of those jurisdictions or the cross-border data transfer conditions.
- Cryptographic technology is adopted and used without any review of the related legal restrictions (import/export/use regulation).
- Security/privacy requirements stated in contracts are not identified and so do not translate into actual implementation or evidence.