ISO 27001 Information Security Management Standard

Part 37 - A18 Compliance

It almost goes without saying that when you commit to ISO 27001 that you then must commit to all your legal, statutory, regulatory or contractual obligations.

It seems a strange thing to say but you need to commit to the laws of the countries you are in and the requirements of your customers.

But some organisations do consciously breach these obligations. If you seek ISO 27001 then your organisation can’t consciously breach requirements.

The Annex A starts with compliance with legal and contractual requirements.

COMPLIANCE

A.18.1 Compliance with legal and contractual requirements

The objective of this is to avoid breaches of legal, statutory, regulatory or contractual obligations related to information security and of any security requirements.

The clause then lists what you need to achieve:

Identification of applicable legislation and contractual requirements. You need to explicitly identify, document and kept up to date all relevant legislative statutory, regulatory, contractual requirements.
Intellectual property rights. You need to implement appropriate procedures ensure compliance with legislative, regulatory and contractual requirements related to intellectual property rights and use of proprietary software products.
Protection of records. You need records to be protected from loss, destruction, falsification, unauthorized access and unauthorized release, in accordance with legislator, regulatory, contractual and business requirements.
Privacy and protection of personally identifiable information. Your privacy and protection of personally identifiable information shall be protected as required in relevant legislation and regulation where applicable.
Regulation of cryptographic controls. Your cryptographic controls must be used in compliance with all relevant agreements, legislation and regulations.

A.18.2 Information Security Reviews

The objective of this is to ensure that information security is implemented and operated in accordance with the organizational policies and procedures.

Independent review of information security. Your organisation’s approach to managing information security and its implementation (i.e. control objectives, controls, policies, processes and procedures for information security) shall be reviewed independently at planned intervals or when significant changes occur.
Compliance with security policies and standards. You Managers need to regularly review the compliance of information processing and procedures within their area of responsibility with the appropriate security policies, standards and any other security requirements.
Technical compliance review. Your information systems shall be regularly reviewed for compliance with the organization’s information security policies and standards.

Takeaways

Commit to the laws of the countries you are in and the requirements of your customers.
Identification of applicable legislation and contractual requirements.
Manage intellectual property rights.
Protect your records.
Protect the privacy and protection of personally identifiable information.
Ensure your cryptographic controls meet regulation
Independently review your information security.
Your Managers need to regularly review the compliance of information processing and procedures within their area of responsibility.
Conduct technical compliance reviews.

View previous blogs in this series "ISO 27001 Information Security Management Standard":

Part 1 - Reasons why you need to meet this standard

Part 2 - Principle 1 - Analysing the Protection of Your Information and then Applying Controls

Part 3 - Principle 2 - Awareness of the Need for Information Security

Part 4 - Principle 3 - Assignment of Responsibility for Information Security

Part 5 - Principle 4 - Incorporating Management Commitment and the Interests of Stakeholders

Part 6 - Principle 5 - Enhancing Societal Values

Part 7 - Principle 6 - Risk assessments determining appropriate controls to reach acceptable levels of risk

Part 8 - Principle 7 - Security incorporated as an essential element of information networks and systems

Part 9 - Principle 8 - Active prevention and detection of information security incidents

Part 10 - Principle 9 - Ensuring a comprehensive approach to information security management

Part 11 - Principle 10 - Continual reassessment of information security and making of modifications as appropriate