In this ultimate how to audit guide to ISO 27001 Annex A 5.31 Legal, Statutory, Regulatory and Contractual Requirements, you will learn directly from an ISO 27001 Lead Auditor:
- 10 Key Audit Steps
- Verification Criteria
- Required Evidence
- The Pass / Fail Test
I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.
Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.
Table of contents
- 1. Comprehensive Legal and Regulatory Register Verified
- 2. Contractual Security Obligation Inventory Confirmed
- 3. Intellectual Property (IP) Protection Controls Validated
- 4. Protection of Records (Retention and Disposal) Verified
- 5. Data Privacy and PII Protection Compliance Confirmed
- 6. Cryptographic Control Regulatory Alignment Verified
- 7. Independent Compliance Review Records Identified
- 8. Management Accountability for Legal Compliance Confirmed
- 9. Technical Access to Legal Information Validated
- 10. Transborder Data Transfer Controls Verified
Auditing ISO 27001 Annex A 5.31 is the systematic verification of an organization’s adherence to jurisdictional and contractual mandates. The Primary Implementation Requirement is a maintained legal register, ensuring the Business Benefit of total regulatory alignment, avoided litigation, and the protection of essential intellectual property assets.
1. Comprehensive Legal and Regulatory Register Verified
Verification Criteria: A maintained register identifies all applicable legislation, statutory requirements, and regulatory obligations relevant to the ISMS scope and jurisdiction.
Required Evidence: Legal and Regulatory Register (or Compliance Matrix) showing specific acts (e.g., UK Data Protection Act 2018, NIS2 Directive) and their impact on security controls.
Pass/Fail Test: If the organisation cannot produce a list of specific laws and regulations applicable to its industry and geography, mark as Non-Compliant.
2. Contractual Security Obligation Inventory Confirmed
Verification Criteria: An inventory or repository exists that extracts and tracks specific information security clauses from client and vendor contracts.
Required Evidence: Contractual Obligations Tracker or a centralised CRM/Legal folder containing security annexes from active Master Service Agreements (MSAs).
Pass/Fail Test: If security requirements from a major client contract are not reflected in the organisation’s internal control objectives, mark as Non-Compliant.
3. Intellectual Property (IP) Protection Controls Validated
Verification Criteria: Technical and organisational controls are implemented to protect intellectual property in accordance with legal and contractual requirements.
Required Evidence: Software asset register showing license validity, and Data Loss Prevention (DLP) logs protecting proprietary source code or designs.
Pass/Fail Test: If the organisation is using unlicensed commercial software or lacks controls to prevent unauthorised IP exfiltration, mark as Non-Compliant.
