How to Implement ISO 27001 Annex A 5.31

Implementing ISO 27001 Annex A 5.31 involves identifying and documenting all relevant legislative, regulatory, and contractual obligations. The primary implementation requirement is maintaining an up-to-date legal register that maps specific laws to internal security controls, ensuring the business benefit of reduced legal liability and demonstrable compliance with global data protection standards.

ISO 27001 Annex A Legal, statutory, regulatory and contractual requirements Implementation Checklist

Use this implementation checklist to achieve compliance with ISO 27001 Annex A 5.31. True compliance involves a forensic review of the specific legislative frameworks and contractual clauses that bind your organisation, rather than relying on a generic “Global Law” template provided by a GRC vendor.

1. Define Legislative Jurisdictions

Control Requirement: The organisation must identify the specific laws and regulations applicable to its information security operations.

Required Implementation Step: Consult with legal counsel to explicitly list every country and state where you process data or have physical assets. You must document the specific computer misuse, data protection, and electronic transaction acts applicable to those territories, rather than guessing based on your website traffic.

Minimum Requirement: A documented list of jurisdictions (e.g., “UK DPA 2018”, “EU GDPR”, “California CCPA”) verified by a qualified legal professional.

2. Construct a Detailed Legal Register

Control Requirement: All relevant legal, statutory, regulatory, and contractual requirements must be documented and kept up to date.

Required Implementation Step: Create a centralised spreadsheet or database known as the “Legal Register”. Map specific clauses of legislation (e.g., “GDPR Article 32”) directly to your internal policies and controls, ensuring you can prove exactly how you satisfy each requirement.

Minimum Requirement: A version-controlled Legal Register with columns for “Legislation”, “Specific Requirement”, “Internal Control Owner”, and “Compliance Status”.

3. Document Intellectual Property Rights (IPR) Compliance

Control Requirement: Procedures must be implemented to ensure compliance with legislative, regulatory, and contractual requirements on the use of material which may be subject to intellectual property rights.

Required Implementation Step: Run a software asset management audit to reconcile installed software against purchased licenses. You must physically verify that you possess valid licenses for every proprietary tool in use and remove any “cracked” or unauthorised shareware immediately.

Minimum Requirement: A license reconciliation report showing a surplus or exact match of licenses to installations.

4. Establish a Records Retention Schedule

Control Requirement: Records must be protected from loss, destruction, falsification, unauthorised access, and unauthorised release, in accordance with legislative, regulatory, contractual, and business requirements.

Required Implementation Step: Draft a Data Retention Policy that explicitly states the retention period for different data types (e.g., “Financial Records: 7 Years”, “HR Records: 6 Years”). Configure your backup systems and database purging scripts to automatically enforce these limits.

Minimum Requirement: A published Retention Schedule linked to automated deletion scripts or manual purging procedures.

5. Review Cryptographic Regulations

Control Requirement: Controls must be used in compliance with all relevant agreements, legislation, and regulations.

Required Implementation Step: Check the export control regulations of your country (e.g., Wassenaar Arrangement) regarding the use and export of cryptographic hardware or software. If you develop software using strong encryption, verify you are not inadvertently violating export restrictions when deploying to restricted nations.

Minimum Requirement: A written assessment of cryptographic usage against local export control laws.

6. Analyse Contractual Security Obligations

Control Requirement: The organisation must identify and meet requirements arising from contracts with customers and suppliers.

Required Implementation Step: Manually review all active Master Services Agreements (MSAs) and Data Processing Agreements (DPAs). Extract specific security clauses (e.g., “Must notify of breach within 24 hours”, “Must hold Cyber Essentials Plus”) and add them to your Legal Register as mandatory controls.

Minimum Requirement: A “Client Commitments” register detailing every unique security promise made in customer contracts.

7. Assign Individual Responsibility

Control Requirement: Specific managers must be responsible for ensuring compliance with specific requirements.

Required Implementation Step: Update job descriptions to include responsibility for specific compliance areas. For example, the HR Director should be explicitly named as the owner of employment law compliance, while the CTO owns software licensing compliance.

Minimum Requirement: Documented role assignments linking specific individuals to specific rows in the Legal Register.

8. Subscribe to Legislative Updates

Control Requirement: The organisation must remain updated on changes to relevant legislation.

Required Implementation Step: Purchase a subscription to a professional legal update service or assign a legal counsel to provide quarterly briefings. Do not rely on Twitter or tech blogs; you need a formal mechanism to alert you when laws (like the UK Data Protection and Digital Information Bill) change.

Minimum Requirement: Evidence of a professional subscription or a quarterly “Legal Update” meeting minute.

9. Verify Privacy and PII Protection Measures

Control Requirement: Compliance with privacy and protection of personally identifiable information must be ensured.

Required Implementation Step: Maintain a detailed Record of Processing Activities (RoPA) as required by GDPR Article 30. This must map the flow of PII through your systems, identifying exactly where data is stored, who processes it, and the legal basis for processing.

Minimum Requirement: An up-to-date RoPA document covering all data processing activities.

10. Conduct Annual Compliance Reviews

Control Requirement: The organisation’s approach to meeting legal and contractual requirements must be reviewed independently.

Required Implementation Step: Commission an independent internal or external audit specifically to test compliance against the Legal Register. The auditor must verify that the controls listed in the register are actually effective in practice, not just on paper.

Minimum Requirement: An audit report titled “Legal and Contractual Compliance Review” with findings and remediation actions.

ISO 27001 Annex A 5.31 SaaS / GRC Platform Implementation Failure Checklist

Control Requirement	The ‘Checkbox Compliance’ Trap	The Reality Check
Identification of Law	The tool auto-populates “All Global Laws” (GDPR, HIPAA, CCPA) regardless of relevance.	You need a curated list specific to your operations. Identifying irrelevant laws wastes audit time.
Contractual Obligations	A generic “Contract Review” policy template.	Auditors require a register of actual clauses extracted from actual signed contracts.
IPR / Licensing	A checkbox saying “We do not pirate software.”	You need a technical scan of your network to prove license counts match installed instances.
Regulation Updates	The SaaS vendor updates their platform content silently.	You need a documented process where you review the changes and assess the impact on your risk.
Records Retention	A generic policy saying “We keep data for 7 years.”	You need technical evidence (e.g., CRON job logs) showing data is actually being purged.
Crypto Regulations	Ignoring export controls because “we use cloud.”	If you deploy code, you are responsible for where that encryption travels. Tools ignore this.
Ownership	Assigning everything to the “Compliance Officer.”	Specific laws need specific owners (e.g., HR for employment law). Generalists cannot manage specifics.
Privacy (RoPA)	A simple “Privacy Policy” generated for the website.	GDPR requires a granular Record of Processing Activities (RoPA), which website generators do not create.

About the author