ISO 27001 A.5.31: Manage Security Obligations

What A.5.31 requires in practice

Control A.5.31 asks the organisation to identify and document the laws, regulations and contractual obligations that bear on information security, together with its approach to meeting them, and to keep that up to date. The control covers obligations from laws, regulators and client contracts alike.

In practice there are three parts: finding out which obligations apply given where you operate, whom you serve and what information you handle; recording them with enough clarity that owners know what is expected; and describing how the organisation meets each one. Keeping the record current is part of the control, since laws and contracts change. The control does not require legal opinions on everything. A maintained list of obligations with owners, reviewed when circumstances change, is one practical method.

Identify requirements from actual activities

Start with what the organisation does, where it operates, what information it handles and what commitments it has made. Relevant requirements may arise from customer agreements, supplier terms and other contracts as well as legislation and regulation. New markets, services and information flows can change the assessment.

Use competent sources to determine applicability. A requirement that applies to another company in the same sector may not apply identically to yours. Equally, concentrating only on the headquarters location can miss obligations relevant to other operations or relationships. Record the basis for important applicability decisions and the scope they cover.

Keep the result usable. Describe the obligation at a level that the responsible process owner can act upon, while retaining a reference to the authoritative source or agreed term. Avoid reproducing large legal texts into a register that nobody maintains.

Translate obligations into controls and ownership

For each consequential requirement, identify the process, responsibility and evidence through which it is addressed. A contractual restriction on information sharing might affect access design, approved suppliers and staff instructions. The commercial owner should not assume that signing the agreement automatically changes those systems.

Distinguish interpretation from implementation. Appropriate expertise determines what the obligation means for the activity; operational owners establish and run the necessary controls. Security staff can coordinate the connection without claiming authority to resolve every legal question.

Where obligations appear to conflict, use an authorised resolution route. Do not silently select the most convenient interpretation or assume that accepting risk can waive an externally binding requirement. Record the decision and relevant advice so that future changes do not reopen the same ambiguity unknowingly.

Why knowing your security obligations matters to the business

Breaching a legal or contractual duty can bring fines, lost contracts and reputational harm, and ignorance is rarely accepted as a defence. Organisations working across several countries or serving regulated clients face a changing set of obligations that no individual can hold in their head. A documented view lets management decide with open eyes, helps teams design systems that comply from the start and shortens the response to client questionnaires. For auditors, it explains why other controls exist and shows the system is tied to real-world duties.

How to implement A.5.31

Treat this as a living list owned by a named person with access to legal advice. One practical path follows. This control rewards steady upkeep more than a single large exercise. Give one person ownership of the register of obligations and give them regular contact with legal advice and with the teams signing client contracts. New contracts are a rich source of obligations, so make sure security terms are passed to operations rather than staying in the contract file. Keep the record simple enough that people actually read it.

1. Identify the countries, sectors and client groups your business touches.
2. Gather the laws, regulations and contract terms that bear on information security.
3. Record each obligation in plain language with a responsible owner.
4. Describe how the organisation meets each one, linking to the relevant controls.
5. Confirm interpretation with legal advisers where meaning is uncertain.
6. Set triggers for review, such as new markets, new clients or legal changes.
7. Report changes to management and update affected procedures.

Illustrative software example: a new customer commitment

Illustrative construction example: project record requirements change

A hypothetical contractor accepts a revised project agreement with different requirements for retaining and handing over sensitive project records. Document control continues using the previous project’s retention and handover rules because the change never reaches the team.

The organisation introduces a review route from contract variation to record ownership and operational instructions. It verifies a representative record’s storage, retrieval and handover path. The control closes the gap between an agreed requirement and the people who must fulfil it, rather than merely adding another contract to an archive.

Keep requirements current through change

Define how changes in authoritative sources and contracts are identified, assessed and communicated. The review should consider business changes as well as external changes. A new service can make an existing rule relevant even when the rule itself has not changed.

Assign ownership for updates and the affected actions. Check whether policies, technical settings, training and supplier terms need revision. Relevant cryptography or cross-border questions may require specialist assessment; avoid assuming one global rule applies to every implementation.

Evidence and practical review

Common nonconformities with A.5.31

Findings usually show obligations known informally but not recorded. Findings usually show obligations known informally but not recorded. An auditor often asks the person responsible which laws and client terms apply, then checks whether the answers match a maintained record.

• No list of applicable legal and contractual requirements.
• A list prepared once and never updated after expansion into new markets.
• Client contract security terms that operational teams have never seen.
• Obligations recorded without any account of how they are met.