ISO 27001:2022 Annex A 5.31 – Legal, Statutory, Regulatory and Contractual Requirements

What Is the Purpose of ISO 27001:2022 Annex A 5.31?

Legislation, regulations, and contractual obligations make up a significant portion of an organisation’s information security responsibilities.

Organisations should grasp their responsibilities at all times, and be ready to modify their information security measures to fit their role as a reliable data handler.

It is noteworthy that Annex A 5.31 does not explicitly list any legal, regulatory or contractual obligations that organisations need to adhere to or be compliant with. Similarly, it does not provide a method for drafting contracts. Instead, it focuses on what organisations need to consider from an information security standpoint, taking into account their individual requirements.

General Guidance on ISO 27001:2022 Annex A 5.31

Organisations must bear in mind their legal, statutory, regulatory, and contractual obligations when:

• Drafting or amending their information security procedures and internal policies.
• Design, alter, and execute information security controls.
• When assessing their broader data security needs, both for organisational or third-party-related situations (e.g. suppliers), organisations must categorise their information security.
• Carrying out risk assessments related to data security activities, such as internal roles and the organisational structure.
• Determining the nature of the supplier relationship, as well as their contractual obligations throughout the supply chain.

Legislative and Regulatory Guidance

Organisations should clearly outline and record internal procedures and roles so that they can:

• Identify, analyse, and comprehend their legal and regulatory requirements regarding information security, including consistent evaluations of laws and regulations.
• Ensure that they stay compliant with all legal and regulatory requirements in every nation they operate in, as well as any products and services from outside the country.

Cryptographic Guidance

Cryptography is a technique for protecting information and communications by encoding them. It provides a way to secure information, enabling secure communication between two parties.

The use of encryption and cryptography necessitates complying with specified legal regulations and considerable regulatory advice relevant to the subject.

Considering this, one should be aware of the following directives:

• Import/export laws regarding cryptographic hardware or software which performs or can perform a dedicated cryptographic function.
• Legislation related to limiting cryptographic functions.
• Authorities in any country or region have the authority to request and enforce access to encrypted information.
• The accuracy and reliability of three fundamental digital components of encrypted data:
• Seals.
• Certificates.
• Signatures.

Contractual Guidance

Organisations must bear in mind their information security responsibilities when constructing or authorising legally binding contracts with customers, providers, or vendors (such as insurance policies and contracts).

Refer to Annex A 5.20 in ISO 27001:2022 for additional support regarding supplier contracts.

Accompanying Annex A Controls

• ISO 27001:2022 Annex A 5.20

Changes and Differences from ISO 27001:2013

ISO 27001:2022 Annex A 5.31 replaces two controls from ISO 27001:2013 in the revised standard, these are:

1. 18.1.1 – Identification of Applicable Legislation and Contractual Requirements
2. 18.1.5 – Regulation of Cryptographic Controls

Whereas ISO 27001:2013 Annex A 18.1.1 provides little guidance apart from the requirement for “managers” to identify all applicable laws for their business, ISO 27001:2022 Annex A 5.31 discusses compliance with legislative, regulatory and cryptographic standards, as well as offering some general advice and going into greater depth on how to meet any relevant legislation or regulations.

ISO 27001:2022 Annex A 5.31 follows the same principles as ISO 27001:2013 Annex A 18.1.5 and includes the same underlying guidance points, however it goes one step further, demanding organisations to contemplate hardware and software that may perform cryptographic functions.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

Our step-by-step checklist makes ISO 27001:2022 implementation easier. It takes you from defining the scope of your ISMS to implementing risk identification and control.

Contact us now to arrange a demonstration.