ISO 27001 Legal, statutory, regulatory and contractual requirements
In this ultimate guide to ISO 27001 Annex A 5.31 Legal, statutory, regulatory and contractual requirements you will learn
- What is ISO 27001 Annex A 5.31
- How to implement ISO 27001 Annex A 5.31
I am Stuart Barker, the ISO 27001 Ninja and author of the Ultimate ISO 27001 Toolkit.
With over 30 years industry experience I will show you what’s new, give you ISO 27001 templates, show you examples, do a walkthrough and show you how to implement it for ISO 27001 certification.
Table of contents
- ISO 27001 Legal, statutory, regulatory and contractual requirements
- What is ISO 27001 Annex A 5.31?
- Implementation Guide
- Watch the tutorial
- ISO 27001 Templates
- What are the benefits of Legal, statutory, regulatory and contractual requirements?
- Why are legal, statutory, regulatory and contractual requirements important?
- ISO 27001 Controls and Attribute values
What is ISO 27001 Annex A 5.31?
ISO 27001 Annex 5.31 Legal, statutory, regulatory and contractual requirements is an ISO 27001 Annex A control that wants you understand external requirements on your information security and implement them. Specifically it is concerned with legal, regulatory, statutory and contractual requirements that may include specifics directly related to how you manage and implement information security.
Purpose
The purpose of ISO 27001 Annex A 5.31 Legal, statutory, regulatory and contractual requirements is to ensure you comply with legal, statutory, regulatory and contractual requirements related to information security.
An organisations information security responsibilities are informed by laws, regulations and contractual requirements.
Organisations should have a clear understanding of their obligations and be prepared to include those in their information security practices.
Definition
The ISO 27001 standard defines ISO 27001 Annex A 5.31 as:
Legal, statutory, regulatory and contractual requirements relevant to information security and the organisations approach to meet these requirements should be identified, documented and kept up to date.
ISO 27001:2022 Annex A 5.31 Legal, statutory, regulatory and contractual requirements
Implementation Guide
Annex A 5.31 requirements are to understand and record the requirements on your information security from any legal, statutory, regulatory or contractual requirements.
There are 5 general guidance points to consider.
Organisation’s should take into consideration external requirements for their legal, statutory, regulatory and contractual requirements when:
- Developing your information security policies and processes
- Developing or changing your information security controls
- Classifying your data and assets
- Doing risk assessments and risk management
- Performing supplier management and supplier contracts
Legal and Regulatory Guidance on Control A 5.31
You should record your legal and regulatory requirements in an ISO 27001 Legal Register.
You are going to identify all of the laws and regulations that apply to you and write them down in order to be aware of the requirements and how they apply to you.
It is best practice to get legal advice to help you comprise this list.
It can be difficult as you have to consider the compliance requirements of all the countries in which you operate. This includes the transfer of information across borders where those countries laws could apply to you.
Cryptographic Guidance on Control A 5.31
It is recommended to get legal advice on all aspects of this control, including on the cryptography. It can be quite specialised in its requirements.
The legal advice will look at any restrictions on the import and export of cryptographic technologies and usage.
A significant one to note is the requirements of in country requirements to access encrypted information.
All in all, get some legal advice.
Contract Guidance on Control A 5.31
Which contracts could have requirements that impact your information security implementation? Well there are many but they would include
- contracts with your suppliers
- contracts with your clients
- contracts with your insurers
- contracts with your investors / funding
Guidance relating to supplier contracts is covered in ISO 27001 Annex A 5.20
Watch the tutorial
ISO 27001 Templates
Having an ISO 27001 template for control 5.31 can help fast track your implementation. You can read a beginners guide to the ISO 27001 Legal Register and you can download a copy of the ISO 27001 Legal Register that comes pre populated with common laws. As always, you should seek legal advice.
DO IT YOURSELF ISO 27001
All the templates, tools, support and knowledge you need to do it yourself.
What are the benefits of Legal, statutory, regulatory and contractual requirements?
Other than your ISO 27001 certification requiring it, the following are the top 5 benefits of ISO 27001 Annex A 5.31 Legal, statutory, regulatory and contractual requirements:
- You cannot get ISO 27001 certification without it.
- Improved security: You will have an effective information security implementation that meets your external requirements for law, regulation, statute and contracts
- Reduced risk: You will reduce the information security risks of not meeting external requirements and obligations
- Improved compliance: Standards and regulations require you to meet your external requirements
- Reputation Protection: In the event of a breach having an effective legal, regulatory, statutory and contract process in place will reduce the potential for fines and reduce the PR impact of an event
Why are legal, statutory, regulatory and contractual requirements important?
In a highly regulated world, no matter what sector you work in or where in the world you work there are bodies that have very specific requirements for information security that relate directly to you. These can be written in to contracts, the laws of the land, the regulations of regulators under which you come and more. Having a thorough understanding of what those external requirements are and how you meet them will mean that you do not violate them and suffer the consequences. The consequences can be severe, ranging from fines, criminal prosecution, repetitional impact and loss of customers. Work out what your requirements are, get legal advice and implement those requirements.
ISO 27001 Controls and Attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Availability | Identify | Legal and compliance | Protection |
| Confidentiality | Governance and EcoSystem | |||
| Integrity |
