ISO 27001 Annex A 5.31 Legal, statutory, regulatory and contractual requirements

In this article I lay bare ISO 27001 Annex A 5.31 Legal, statutory, regulatory and contractual requirements.

Using over two decades of experience on hundreds of ISO 27001 audits and ISO 27001 certifications I am going to show you what’s new, give you templates, an ISO 27001 toolkit, show you examples and do a walkthrough.

In this ISO 27001 certification guide I show you exactly what changed in the ISO 27001:2022 update. 

I am Stuart Barker the ISO 27001 Ninja and this is ISO 27001 Annex 5.31 Legal, statutory, regulatory and contractual requirements.

What is How To Implement ISO 27001 Annex A 5.31 Legal, statutory, regulatory and contractual requirements?

ISO 27001 Annex 5.31 Legal, statutory, regulatory and contractual requirements is an ISO 27001 control that wants you understand external requirements on your information security and implement them. Specifically it is concerned with legal, regulatory, statutory and contractual requirements that may include specifics directly related to how you manage and implement information security.

ISO 27001 Annex A 5.31 Purpose

The purpose of ISO 27001 Annex A 5.31 Legal, statutory, regulatory and contractual requirements is to ensure you comply with legal, statutory, regulatory and contractual requirements related to information security.

An organisations information security responsibilities are informed by laws, regulations and contractual requirements.

Organisations should have a clear understanding of their obligations and be prepared to include those in their information security practices.

ISO 27001 Annex A 5.31 Definition

The ISO 27001 standard defines ISO 27001 Annex A 5.31 as:

Legal, statutory, regulatory and contractual requirements relevant to information security and the organisations approach to meet these requirements should be identified, documented and kept up to date. 

ISO 27001:2022 Annex A 5.31 Legal, statutory, regulatory and contractual requirements

ISO 27001 Annex A 5.31 Implementation Guide

Annex A 5.31 requirements are to understand and record the requirements on your information security from any legal, statutory, regulatory or contractual requirements.

There are 5 general guidance points to consider.

Organisation’s should take into consideration external requirements for their legal, statutory, regulatory and contractual requirements when:

• Developing your information security policies and processes
• Developing or changing your information security controls
• Classifying your data and assets
• Doing risk assessments and risk management
• Performing supplier management and supplier contracts

Legal and Regulatory Guidance on Control A 5.31

You should record your legal and regulatory requirements in an ISO 27001 Legal Register.

You are going to identify all of the laws and regulations that apply to you and write them down in order to be aware of the requirements and how they apply to you.

It is best practice to get legal advice to help you comprise this list.

It can be difficult as you have to consider the compliance requirements of all the countries in which you operate. This includes the transfer of information across borders where those countries laws could apply to you.

Cryptographic Guidance on Control A 5.31

It is recommended to get legal advice on all aspects of this control, including on the cryptography. It can be quite specialised in its requirements.

The legal advice will look at any restrictions on the import and export of cryptographic technologies and usage.

A significant one to note is the requirements of in country requirements to access encrypted information.

All in all, get some legal advice.

Contract Guidance on Control A 5.31

Which contracts could have requirements that impact your information security implementation? Well there are many but they would include

• contracts with your suppliers
• contracts with your clients
• contracts with your insurers
• contracts with your investors / funding

Guidance relating to supplier contracts is covered in ISO 27001 Annex A 5.20

ISO 27001 Annex A 5.31 Templates

Having an ISO 27001 template for control 5.31 can help fast track your implementation. You can read a beginners guide to the ISO 27001 Legal Register and you can download a copy of the ISO 27001 Legal Register that comes pre populated with common laws. As always, you should seek legal advice.

What are the Benefits of Legal, statutory, regulatory and contractual requirements?

Other than your ISO 27001 certification requiring it, the following are the top 5 benefits of ISO 27001 Annex A 5.31 Legal, statutory, regulatory and contractual requirements: 

1. You cannot get ISO 27001 certification without it.
2. Improved security: You will have an effective information security implementation that meets your external requirements for law, regulation, statute and contracts
3. Reduced risk: You will reduce the information security risks of not meeting external requirements and obligations
4. Improved compliance: Standards and regulations require you to meet your external requirements
5. Reputation Protection: In the event of a breach having an effective legal, regulatory, statutory and contract process in place will reduce the potential for fines and reduce the PR impact of an event

Why are Legal, statutory, regulatory and contractual requirements important?

In a highly regulated world, no matter what sector you work in or where in the world you work there are bodies that have very specific requirements for information security that relate directly to you. These can be written in to contracts, the laws of the land, the regulations of regulators under which you come and more. Having a thorough understanding of what those external requirements are and how you meet them will mean that you do not violate them and suffer the consequences. The consequences can be severe, ranging from fines, criminal prosecution, repetitional impact and loss of customers. Work out what your requirements are, get legal advice and implement those requirements.

Matrix of ISO 27001 Controls and Attribute values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Availability	Identify	Legal and compliance	Protection
	Confidentiality			Governance and EcoSystem
	Integrity