Skip to main content
All measures

Measure · ISO 27001 and other standards

Maintain legal and contractual obligations

Record which legal and contractual obligations affect your information security. Connect the specific provision to its owner and the agreed implementation.

Accountable: ISMS managerReviewed

Reuse existing records

Use the existing contract or compliance register. Add the relevant obligations and link existing tasks or policies there, rather than maintaining a second legal register with the same content.

What to do

  1. 1

    Select relevant obligations

    Check applicable legislation and agreed contract clauses for the services and locations assessed. Record the provision, version and reason for applicability, and flag unclear cases.

  2. 2

    Assign implementation

    Record what the obligation requires and who owns the relevant procedure. Link the existing measure, policy or task and take binding deadlines from the checked source.

  3. 3

    Maintain changes through existing procedures

    Check affected entries when contracts, services or relevant legislation change. Also use your established periodic review and update the affected tasks as needed.

Worked example

Example of a customer agreement

A customer contract contains a commitment to provide information about security incidents.

Contractual incident notification
DecisionAdd the contact route and agreed deadline to the existing incident procedure.
EvidenceThe contract provision and current procedure identifying the responsible person.

Record the result

  • Existing register identifying the provision, applicability and responsible person.
  • Linked implementation, such as the current policy or a completed task.

Common implementation mistakes

Recording only the name of the law

Add the specific obligation and affected service.

Customer commitments never reach operations

Assign the commitment to an existing procedure and a responsible person.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.5.31 · Rechtliche, gesetzliche, regulatorische und vertragliche AnforderungenGerman guide

    The specific obligation remains linked to its source, applicability, owner and implementation.

  • TISAX · 7.1.1

    VDA ISA 6.0.3 · Partial overlap

    Sources, justified applicability and recorded review decisions support the assessment of relevant provisions. Check implementation of each obligation against the actual result as well.

    Reference

  • GDPR · Art. 5(2), 24

    EU 2016/679 · Supporting contribution

    For personal data, the register supports ownership and accountability. The lawfulness of the processing still needs assessment.

    Reference

Resources for your next step

Sources and further reading