Templates and records · ISO 27001 · Clause A.5.31
Register of legal and contractual security requirements
The list of laws, regulations and contracts that place security obligations on the company, what each one demands and how it is met.
In one sentence
The register of legal and contractual requirements identifies the laws, regulations and contracts that impose security obligations —data protection, NIS2, the Spanish National Security Framework (ENS), customer clauses— and explains how each one is met; it is required by control 5.31 of ISO/IEC 27001:2022, which calls for them to be identified, documented and kept up to date.
- Where the standard requires it
- ISO 27001 · Clause A.5.31 Clauses follow ISO/IEC 27001:2022; those beginning with “A.” are Annex A controls, required to the extent that the statement of applicability includes them.
- Type of information
- Mandatory document Annex A control 5.31, which requires them to be documented and kept up to date
- Who fills it in
- Information security manager with legal counsel Contracts are supplied by whoever signs them: sales, purchasing
- When
- When the law changes or a contract is signed With a full review at least once a year
- How long it is kept
- Always current It is kept up to date; previous versions show since when each obligation was known
What the standard requires
What ISO 27001 demands and what it leaves to your judgement
Clause 4.2 asks you to understand the requirements of interested parties, and control 5.31 narrows that down to those arising from laws, regulations and contracts: identify them, document them and keep them current, together with the approach to meeting them.
Unlike the obligations register of a compliance management system, this one is limited to what affects information security. It serves two purposes: it feeds the risk assessment and it justifies including controls in the statement of applicability.
Neighbouring controls complete the picture: intellectual property rights (5.32), protection of records (5.33) and privacy and protection of personal data (5.34).
Structure
Fields the template should include
- Source law or contract, with its reference
- Specific security requirement it imposes
- Scope: which processes, systems or data it affects
- How it is met: control, procedure or evidence
- Person responsible
- Any notification or response deadlines it sets
- Date identified and date last reviewed
Example
Example: three requirements at a software company
Company, people and figures are fictitious: the example only shows what a properly completed record looks like.
| Field | Content |
|---|---|
| GDPR, art. 33 | Notify personal data breaches to the supervisory authority within 72 hours · Incident procedure PS-08 · Data protection officer |
| GDPR, art. 28 | Processing agreement with every customer that entrusts us with data · Approved contract template · Sales and legal |
| Contract with a public-sector customer (fictitious) | Comply with the ENS at medium category · Certification planned · Information security manager |
| Contract with an insurance customer (fictitious) | Report serious incidents within 24 hours · Added to procedure PS-08 |
| Last review | 15 July 2026 |
At the audit
Mistakes auditors commonly flag
- A list of laws that does not say what they require or how they are met.
- Security commitments in customer contracts are missing.
- Contractual notification deadlines that the incident procedure ignores.
- No review after new rules come into force, such as the national transposition of NIS2.
In Kimobox
How this record is kept in Kimobox
- 1Interested parties and their security requirements are registered in a versioned table.
- 2Each requirement is linked to the control or procedure that meets it, in the statement of applicability.
- 3The periodic review is scheduled and alerts the person responsible.
Frequently asked questions
What people ask us before getting started
Is it the same as the ISO 37301 obligations register?
No. The ISO 37301 register covers all of the organisation’s compliance obligations; this one is limited to those affecting information security. If both systems are in place, the security register can be a filtered view of the general one.
Should customer contracts be included?
Yes. Control 5.31 expressly refers to contractual requirements, and these tend to be the most demanding: incident notification deadlines, customer audits or data location.
Keep your ISO 27001 records without loose templates
We'll show you the module running with data similar to yours.
Keep exploring
Related pages
ISO 37301 compliance obligations register template
How to document the compliance obligations ISO 37301 asks for: mandatory requirements and voluntary…
Context of the organization
The information security system starts by knowing which assets need protecting and who holds expectations…
ISO 27001 statement of applicability template
What the ISO 27001 statement of applicability (6.1.3 d) must contain: necessary controls, justification…
ISO 27001 information security risk assessment template
How to document the information security risk assessment ISO 27001 requires: acceptance criteria, risk…
Sources
Where each figure comes from
References to the official text in force. If a standard is revised, this page is updated and the review date says so.
- ISO/IEC 27001:2022 — Information security management systems. Requirements ISO/IEC · 25 October 2022
- ISO/IEC 27002:2022 — Information security controls ISO/IEC · February 2022
- Regulation (EU) 2016/679, General Data Protection Regulation (GDPR) EUR-Lex · 27 April 2016
- Directive (EU) 2022/2555 (NIS2) EUR-Lex · 14 December 2022