Part 37 - A18 Compliance
It almost goes without saying that when you commit to ISO 27001 that you then must commit to all your legal, statutory, regulatory or contractual obligations.
It seems a strange thing to say but you need to commit to the laws of the countries you are in and the requirements of your customers.
But some organisations do consciously breach these obligations. If you seek ISO 27001 then your organisation can’t consciously breach requirements.
The Annex A starts with compliance with legal and contractual requirements.
A.18.1 Compliance with legal and contractual requirements
The objective of this is to avoid breaches of legal, statutory, regulatory or contractual obligations related to information security and of any security requirements.
The clause then lists what you need to achieve:
- Identification of applicable legislation and contractual requirements. You need to explicitly identify, document and kept up to date all relevant legislative statutory, regulatory, contractual requirements.
- Intellectual property rights. You need to implement appropriate procedures ensure compliance with legislative, regulatory and contractual requirements related to intellectual property rights and use of proprietary software products.
- Protection of records. You need records to be protected from loss, destruction, falsification, unauthorized access and unauthorized release, in accordance with legislator, regulatory, contractual and business requirements.
- Privacy and protection of personally identifiable information. Your privacy and protection of personally identifiable information shall be protected as required in relevant legislation and regulation where applicable.
- Regulation of cryptographic controls. Your cryptographic controls must be used in compliance with all relevant agreements, legislation and regulations.
A.18.2 Information Security Reviews
The objective of this is to ensure that information security is implemented and operated in accordance with the organizational policies and procedures.
- Independent review of information security. Your organisation’s approach to managing information security and its implementation (i.e. control objectives, controls, policies, processes and procedures for information security) shall be reviewed independently at planned intervals or when significant changes occur.
- Compliance with security policies and standards. You Managers need to regularly review the compliance of information processing and procedures within their area of responsibility with the appropriate security policies, standards and any other security requirements.
- Technical compliance review. Your information systems shall be regularly reviewed for compliance with the organization’s information security policies and standards.
- Commit to the laws of the countries you are in and the requirements of your customers.
- Identification of applicable legislation and contractual requirements.
- Manage intellectual property rights.
- Protect your records.
- Protect the privacy and protection of personally identifiable information.
- Ensure your cryptographic controls meet regulation
- Independently review your information security.
- Your Managers need to regularly review the compliance of information processing and procedures within their area of responsibility.
- Conduct technical compliance reviews.
View previous blogs in this series "ISO 27001 Information Security Management Standard":