A.5.31 Audit Evidence Pack

What the auditor wants to verify

The auditor wants to confirm that applicable legal, statutory, regulatory, and contractual information security requirements are identified, documented, owned, kept current, and mapped to implemented controls.

Evidence to request

Strong evidence

• A current requirements register identifies legal, statutory, regulatory, and contractual information security obligations.
• Each requirement has an owner, review date, jurisdiction or source, applicable scope, control mapping, and evidence location.
• Changes in laws, regulations, or contracts are tracked through change control and update affected controls.
• Cryptography, digital signatures, electronic communication, and cross-border obligations are assessed where relevant.
• Legal or specialist advice is retained for complex jurisdictions or regulated business activities.
• Responsible personnel can explain their obligations and evidence.

Weak evidence

• A generic compliance list exists but is not mapped to controls or evidence.
• Contracts are stored but information security obligations are not extracted.
• No owner is responsible for keeping requirements current.
• Cryptographic legal requirements are assumed rather than assessed.
• Requirement changes do not trigger policy, control, or evidence updates.
• International or online business obligations are ignored.

Sample interview questions

• How do you identify applicable legal, regulatory, statutory, and contractual requirements?
• Who owns keeping the requirements register current?
• Show how a requirement maps to a control and evidence.
• How are requirement changes tracked into control changes?
• How have cryptographic legal requirements been assessed for relevant jurisdictions?

Common nonconformities

• Requirements register is incomplete or stale
• Contractual security obligations are not extracted from contracts
• Legal changes are not tied to change control
• Cryptography rules are not assessed by jurisdiction
• No owner is assigned for requirement monitoring

Related notes

• A.5.31 Legal, Statutory, Regulatory and Contractual Requirements
• Legal and Contractual Requirements Register
• A.5.31 Audit Checklist