ISO 27002:2022 – Control 5.31 – Legal, Statutory, Regulatory and Contractual Requirements

Purpose of Control 5.31

Laws, regulations and contractual requirements form a large part of an organisation’s information security responsibilities.

Organisations should have a clear understanding of their obligations at any one time, and be prepared to adapt their information security practices in accordance with their role as a responsible data handler.

It’s important to note that Control 5.31 doesn’t list any specific legal, regulatory or contractual terms that organisations either need to enforce or remain compliant with, nor does it set out a procedure for drafting contracts. Control 5.31 instead focuses on what organisations need to consider from an information security perspective, relating to their unique requirements.

Attributes Table

Control 5.31 is a preventive control that modifies risk by offering guidance on how to operate with a robust information security policy that maintains compliance within all relevant legal and regulatory environments.

General Guidance on Control 5.31

There are 5 general guidance points to consider. Organisation’s should keep in mind their legal, statutory, regulatory and contractual requirements when:

1. Drafting and/or amending their information security procedures and internal policy documents.
2. Designing, amending or implementing information security controls.
3. Categorising information when considering their broader information security requirements, either for organisational purposes or related to their relationships with a third party (suppliers etc.)
4. Undergoing risk assessments relating to information security activities, including internal roles and responsibilities relating to an organisational structure.
5. Establishing the nature of a supplier relationship, and their contractual obligations throughout the supply of products and services.

Legislative and Regulatory Guidance

Organisations should “define and document” internal processes and responsibilities that allow them to:

1. Identify, analyse and understand their legislative and regulatory obligations relating to information security, including periodic reviews of legislation and regulations.
2. Ensure that they remain compliant across all legislative and regulatory environments in whatever countries they operate in. This extends to the use of products and services that originate outside of the country they usually operate in.

Cryptographic Guidance

In ICT, ‘cryptography’ is a method of protecting information and communications through the use of codes.

As such, the whole concept of encryption and cryptography usually involves specific legal requirements and a considerable amount of topic-specific regulatory guidance that need to be adhered to.

With that in mind, the following guidance needs to be taken into consideration:

1. Laws on the import and/or export of hardware or software which either carries out a dedicated cryptographic function, or has the ability to carry out said function.
2. Laws relating to the restriction of cryptographic functions.
3. Any access to encrypted information that authorities within a country or region have the right to request and enforce.
4. The validity and veracity of three key digital elements of encrypted information:

   a) Signatures
   b) Seals
   c) Certificates

Contractual Guidance

Organisations should consider their information security obligations when drafting or signing legally binding contracts with clients, suppliers or vendors (including insurance policies and contracts).

See Control 5.20 for further guidance relating to supplier contracts.

Supporting Controls

• 5.20

Changes and Differences from ISO 27002:2013

27002:2022-5.31 replaces two controls from 27002:2013-18.1.2 (Intellectual property rights).

1. 18.1.1 – Identification of applicable legislation and contractual requirements
2. 18.1.5 – Regulation of cryptographic controls

Whereas 27002:2013-18.1.1 offers minimal guidance other than the need for “managers” to identity all legislation that their type of business warrants, 27002:2022-5.31 discusses adherence across legislative, regulatory and cryptographic environments, as well as offering some generalised guidance points and going into far greater detail regarding how to stay on the right side of any prevailing legislation or regulations.

Where encryption is concerned, 27002:2022-5.31 adheres to the same principles as 27002:2013-18.1.5 and contains the same underlying guidance points, but goes one step further by asking organisations to consider hardware and software that has the potential to carry out cryptographic functions.

New ISO 27002 Controls

How ISMS.online Helps

ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process, from defining the scope of your ISMS through risk identification and control implementation.

Get in touch today to book a demo.