ISO 27001 Annex A 5.31 Compliance with information security legal requirements
What it says
Legal, statutory, regulatory and contractual requirements relevant to information security and the organization's approach to meet these requirements shall be identified, documented and kept up to date.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishIdentify and stay updated on information security legal obligations to avoid breaches.
This control ensures your organisation knows and keeps updated with all the legal rules about information security. If you miss these rules, your business might face fines or other legal issues, which could harm your reputation and finances.
Free. Save your status, tasks and notes.
Why it matters
Failure to track legal requirements could lead to significant fines, litigation risks, and damage to the organisation's reputation.
How to implement
The IT manager should identify all laws and regulations relevant to information security that could affect the business.
This can be done by consulting with legal advisors and checking resources from OAIC for Australian regulations such as the Privacy Act 1988.
The compliance officer should document legal and regulatory requirements.
This involves recording all identified legal obligations in an organised and accessible format, like a compliance register, and ensuring it is stored securely and protected.
The HR team should assign specific roles within the organisation to take responsibility for meeting these requirements.
This might involve designating compliance leadership roles to oversee how well the organisation adapts to changes in legal obligations.
The Procurement department should ensure that contracts with suppliers and clients include clauses that address compliance with information security requirements.
They should work with legal advisors to draft these clauses according to Australian standards.
The organisation's board should conduct regular reviews of these legal requirements and update policies and procedures accordingly.
This can be scheduled as part of quarterly risk review meetings or during the annual policy review process to consider any legislative changes.
Keep it running
Maintain a legal/regulatory obligations register; review quarterly with legal counsel and security, record changes, owners and evidence of compliance actions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the compliance register or document listing legal and regulatory requirements for information security.
Look at
Check that the document is comprehensive, includes updates, and is regularly reviewed.
Good evidence
A well-maintained compliance register with entries showing recent reviews and updates, clearly identifying who is responsible for compliance.
- Check 2 of 5What an auditor asks for
Ask for
Ask to see contracts with suppliers and clients that mention information security requirements.
Look at
Review the contracts for specific clauses that address security compliance and responsibilities.
Good evidence
Contracts with clear, relevant information security clauses that align with identified legal and regulatory requirements.
- Check 3 of 5What an auditor asks for
Ask for
Ask for records of assigned roles and responsibilities related to legal compliance.
Look at
Verify that roles are clearly defined and responsibilities are aligned with compliance tasks.
Good evidence
A clear organisational chart or document showing assigned roles with descriptions detailing compliance duties.
- Check 4 of 5What an auditor asks for
Ask for
Ask for evidence of regular reviews and updates to compliance documents.
Look at
Check for minutes of meetings or change logs regarding updates to compliance documents.
Good evidence
Recent meeting minutes or logs showing discussions and actions on reviewing and updating legal requirement documentation.
- Check 5 of 5What an auditor asks for
Ask for
Ask for any communication or workshops held with staff about compliance requirements.
Look at
Look for attendance records, materials used, and feedback forms from these sessions.
Good evidence
Documented evidence of regular staff engagement activities on compliance topics, indicating active dissemination of information.
Mappings
Closest match in ASD Information Security Manual: ISM-1297, Seek legal advice for personal device access, which this control covers in full and more.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.8.5.
Annex A 8.5 requires the organisation to determine and document obligations to report information about AI systems to interested parties. Annex A 5.31 requires identification, documentation and maintenance of legal, statutory, regulatory and contractual information security requirements. The overlap is in identifying and documenting externally imposed reporting obligations, but Annex A 8.5 is AI-specific, while Annex A 5.31 is broader.
ASD Information Security Manual: 5 mappings
This control is broader than ISM-1297.
ISM-1297 requires legal advice to be sought before privately owned mobile devices and desktop computers are allowed to access systems or data. This identifies the legal and regulatory obligations (such as privacy and investigation rights) that arise from bring your own device arrangements, which is a specific instance of the requirement in Annex A 5.31 to identify and document legal, statutory, regulatory and contractual requirements. Annex A 5.31 applies across all information security matters, while ISM-1297 is limited to privately owned devices.
This control is broader than ISM-1626.
ISM-1626 requires an organisation to seek legal advice when developing and implementing an insider threat mitigation program. This supports ISO/IEC 27001:2022 Annex A 5.31 by helping the organisation identify, interpret, and keep current the legal and regulatory requirements that apply to insider threat activities, such as monitoring, investigations, disciplinary actions, and handling evidence. Annex A 5.31 is broader across all information security legal requirements, while ISM-1626 is a specific legal-engagement action focused on insider threat planning.
This control partially overlaps ISM-1478.
Annex A 5.31 requires the organisation to identify, document, and keep current all information security legal, statutory, regulatory, and contractual requirements and its approach to meeting them. ISM-1478 assigns CISO oversight to ensure the organisation's cyber security program complies with relevant policies, standards, regulations, and legislation, providing governance to drive and assure that Annex A 5.31 obligations are actively managed. ISM-1478 is about accountability and oversight, whereas Annex A 5.31 specifically requires maintaining the register/documentation of obligations and the documented approach to compliance.
This control depends on ISM-0181.
ISM-0181 requires cabling infrastructure to be installed in accordance with relevant Australian Standards, directed by ACMA. Annex A 5.31 mandates organisations to identify, document, and maintain current the legal, statutory, and regulatory information security requirements, potentially including ACMA cabling standards. ISM-0181 is a technical/physical requirement, while Annex A 5.31 is governance-focused on compliance obligations.
This control depends on ISM-0499.
ISM-0499 requires compliance with ASD communications security doctrine and policy produced for HACE management and operation. ISO/IEC 27001:2022 Annex A 5.31 supports this by requiring identification and maintenance of relevant legal, regulatory and contractual information security requirements, which in Australian Government contexts can include ASD policy obligations and direction. ISM-0499 is a direct compliance requirement for a specific ASD policy area, while Annex A 5.31 is the broader obligation-registering and currency process.
ASD Essentials for enterprise IT: 1 mapping
- IT.RES-05.1Build external reporting and coordination obligations into incident response proceduresSupports
This control supports IT.RES-05.1.
IT.RES-05.1 requires external coordination obligations to be integrated into cyber security incident response activities where required. It depends on Annex A 5.31, which requires legal, statutory, regulatory and contractual requirements and the organisation's approach to meeting them to be identified, documented and kept up to date, because obligations must be identified before they can be built into incident response. Annex A 5.31 covers all information security obligations, while IT.RES-05.1 addresses only those relating to external coordination during incidents.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.