An ISMS has to work within the law. ISO 27001 compliance controls make sure you know your legal, regulatory and contractual obligations, protect records and personal data, and check regularly that your own security rules are followed.
In the 2013 edition, these controls formed Annex A.18. The 2022 edition placed them in organizational controls 5.31 to 5.36, with technical compliance checks now supported by control 8.8. This guide explains each one.
Free tool: How ready is your organization? Take our ISO 27001 self-assessment: 30 questions on clauses 4–10 and Annex A.
Mapping: A.18 (2013) to ISO 27001:2022
| ISO 27001:2013 | ISO 27001:2022 |
|---|---|
| A.18.1.1 Applicable legislation, A.18.1.5 Cryptographic controls regulation | 5.31 Legal, statutory, regulatory and contractual requirements |
| A.18.1.2 Intellectual property rights | 5.32 Intellectual property rights |
| A.18.1.3 Protection of records | 5.33 Protection of records |
| A.18.1.4 Privacy and protection of PII | 5.34 Privacy and protection of PII |
| A.18.2.1 Independent review of information security | 5.35 Independent review of information security |
| A.18.2.2 Compliance with policies, A.18.2.3 Technical compliance review | 5.36 Compliance with policies, rules and standards (and 8.8) |
Meeting external obligations
5.31 Legal, statutory, regulatory and contractual requirements
First, identify every requirement that affects information security, and keep the list current. For an Indian company, a register might include:
- the Information Technology Act, 2000 and CERT-In directions on incident reporting;
- the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025;
- sector rules, such as RBI, SEBI or IRDAI cyber security requirements;
- foreign laws for international customers, such as the EU GDPR;
- contract clauses, including security schedules and data processing agreements;
- rules on the use and export of cryptography.
For each item, record the owner and how you meet it.
5.32 Intellectual property rights
Protect your own IP and respect others’. In practice, track software licences, prevent the use of pirated software and respect open-source licence terms. Also, define rules for using copyrighted content, such as images and articles.
5.33 Protection of records
Keep records such as financial data, logs, contracts and HR files for the required period, and protect them from loss, tampering and unauthorized access. A retention schedule helps: it lists each record type, its legal retention period and how to destroy it afterwards.
5.34 Privacy and protection of PII
Personal data needs special care. Therefore, link your ISMS to your privacy programme. Key steps include mapping personal data, defining a lawful basis, honouring individual rights, controlling processors and handling breaches. If you need more detail, ISO/IEC 27701 extends ISO 27001 for privacy management.
For more on what happens when organizations fail here, read the consequences of non-compliance.
Checking your own compliance
5.35 Independent review of information security
Have your security approach reviewed independently at planned intervals and after significant changes. Internal audit, an external consultant or a certification body can do this, as long as they are independent of the area under review.
5.36 Compliance with policies, rules and standards
Managers should check regularly that their teams follow security policies. In addition, technical checks confirm that systems match the rules, for example:
- configuration scans against hardening baselines;
- vulnerability scans and penetration tests (supported by control 8.8);
- access reviews;
- cloud security posture checks.
When you find non-compliance, record it, find the cause and fix it.
What auditors check
- A legal and regulatory register with owners and review dates.
- Software licence records.
- A records retention schedule.
- Privacy documentation, such as data maps and processor agreements.
- Internal audit reports and management review minutes.
- Results of technical compliance checks and follow-up actions.
FAQ
Does ISO 27001 make us compliant with the DPDP Act?
Not automatically. It helps a lot with security safeguards and breach handling. However, the DPDP Act also has duties about consent, notices and individual rights.
How often should we update the legal register?
Review it at least once a year, and whenever a relevant law or contract changes.
Related guides
- ISO 27001:2022 Annex A: all 93 controls and the 2013 mapping
- Free ISO 27001:2022 readiness checklist
- What is an ISMS? Concept, benefits and the PDCA cycle
Sources
- ISO/IEC 27001:2022, Information security management systems (ISO)
- ISO/IEC 27002:2022, Information security controls (ISO)
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. Doing it yourself? The ISO 27001:2022 Starter Kit (₹1,999) gives you the gap workbook, risk register, Statement of Applicability and 13 policy templates. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
