## 5.31 Legal, statutory, regulatory and contractual requirements

| Control type | Information security properties           | Cybersecurity concepts | Operational capabilities | Security domains                      |
| ------------ | ----------------------------------------- | ---------------------- | ------------------------ | ------------------------------------- |
| #Preventive  | #Confidentiality #Integrity #Availability | #Identify              | #Legal_and_compliance    | #Governance_and_Ecosystem #Protection |

**Control**
Legal, statutory, regulatory and contractual requirements relevant to information security and the organization’s approach to meet these requirements should be identified, documented and kept up to date.

**Purpose**
To ensure compliance with legal, statutory, regulatory and contractual requirements related to information security.

**Guidance**

<u>General</u>
External requirements including legal, statutory, regulatory or contractual requirements should be taken into consideration when:

a\) developing information security policies and procedures;

b\) designing, implementing or changing information security controls;

c\) classifying information and other associated assets as part of the process for setting information security requirements for internal needs or for supplier agreements;

d\) performing information security risk assessments and determining information security risk treatment activities;

e\) determining processes along with related roles and responsibilities relating to information security;

f\) determining suppliers’ contractual requirements relevant to the organization and the scope of supply of products and services.

<u>Legislation and regulations</u>

The organization should:

a\) identify all legislation and regulations relevant to the organization’s information security in order to be aware of the requirements for their type of business;

b\) take into consideration compliance in all relevant countries, if the organization:

— conducts business in other countries;

— uses products and services from other countries where laws and regulations can affect the organization;

— transfers information across jurisdictional borders where laws and regulations can affect the organization;

c\) review the identified legislation and regulation regularly in order to keep up to date with the changes and identify new legislation;

d\) define and document the specific processes and individual responsibilities to meet these requirements.

<u>Cryptography</u>
Cryptography is an area that often has specific legal requirements. Compliance with the relevant agreements, laws and regulations relating to the following items should be taken into consideration:

a\) restrictions on import or export of computer hardware and software for performing cryptographic functions;

b\) restrictions on import or export of computer hardware and software which is designed to have cryptographic functions added to it;

c\) restrictions on the usage of cryptography;

d\) mandatory or discretionary methods of access by the countries’ authorities to encrypted information;

e\) validity of digital signatures, seals and certificates.

It is recommended to seek legal advice when ensuring compliance with relevant legislation and regulations, especially when encrypted information or cryptography tools are moved across jurisdictional borders.

<u>Contracts</u>

Contractual requirements related to information security should include those stated in:

a\) contracts with clients;

b\) contracts with suppliers (see [5.20](a-5.20-Addressing-information-security-within-supplier-agreements.md));

c\) insurance contracts. **Other information**

No other information.