Legal, statutory, regulatory and contractual requirements

frameworkISO/IEC 27001:2022 sectionA.5 Organizational controls csf 2.0GV.OC-03 GV.OC-04 GV.PO-02 GV.SC-05 GV.SC-06 GV.SC-07 topicsCompliance frameworks4 6 2

Official text · not licensableTitle: Legal, statutory, regulatory and contractual requirements. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of A.5.31 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-03 GV.OV-03	Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed; Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed	Crosswalk	Same topic: Compliance 5 loosely related (not mappings) GV.OC-04 Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated Loosely related Only shares CSF GV.OC-04: related, not a mapping GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission Loosely related Only shares CSF GV.PO-02: related, not a mapping GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties Loosely related Only shares CSF GV.SC-05: related, not a mapping GV.SC-06 Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships Loosely related Only shares CSF GV.SC-06: related, not a mapping GV.SC-07 The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship Loosely related Only shares CSF GV.SC-07: related, not a mapping
CIS v8.1	CIS 15.4 CIS 15.5 CIS 15.6 CIS 15.7	Ensure Service Provider Contracts Include Security Requirements; Assess Service Providers…	Loosely related	No mapping. Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping
SOC 2	CC4.1 CC4.2	Ongoing and/or separate evaluations of controls; Communicating and remediating control deficiencies	Editorial	Same topic: Compliance (editorial pick) 7 loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF GV.OC-04: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Loosely related Only shares CSF GV.OC-04: related, not a mapping CC1.1 Commitment to integrity and ethical values Loosely related Only shares CSF GV.PO-02: related, not a mapping CC3.1 Objectives specified clearly enough to identify risks Loosely related Only shares CSF GV.OC-04: related, not a mapping CC5.3 Control activities deployed through policies and procedures Loosely related Only shares CSF GV.PO-02: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF GV.OC-04: related, not a mapping
PCI DSS	12.4.2	Service providers: quarterly reviews of operational tasks	Crosswalk	Same topic: Compliance 31 loosely related (not mappings) 12.8.1 List of third-party service providers kept Loosely related Only shares CSF GV.OC-03, GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping 12.8.2 Written agreements with service providers Loosely related Only shares CSF GV.OC-03, GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping 12.8.5 Responsibilities split with each provider documented Loosely related Only shares CSF GV.OC-03, GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.OC-04, GV.SC-06, GV.SC-07: related, not a mapping 12.8.3 Due diligence before engaging service providers Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Loosely related Only shares CSF GV.OC-03, GV.SC-05, GV.SC-07: related, not a mapping 12.9.2 Service providers support customer compliance requests Loosely related Only shares CSF GV.OC-03, GV.SC-05, GV.SC-07: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping …and 23 more in the downloads
CMMC	CA.L2-3.12.1	Security Control Assessment	Editorial	Same topic: Compliance (editorial pick) 1 loosely related (not mappings) RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping
800-53	PM-4 PM-6 CA-2 AC-1 AT-1 AU-1 CA-1 CM-1 CP-1 IA-1 IR-1 MP-1 PE-1 PL-1 PM-1 PS-1 RA-1 SA-1 SC-1 SI-1 SR-1	Plan of Action and Milestones Process; Measures of Performance…	Crosswalk	Same topic: Compliance NIST SP 800-53 → ISO 27001 mapping 15 loosely related (not mappings) SA-4 Acquisition Process Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping SA-9 External System Services Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping SR-6 Supplier Assessments and Reviews Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping MA-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.PO-02: related, not a mapping PT-1 Policy and Procedures Loosely related Only shares CSF GV.OC-03, GV.PO-02: related, not a mapping RA-9 Criticality Analysis Loosely related Only shares CSF GV.OC-04, GV.SC-07: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-05, GV.SC-07: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.SC-05, GV.SC-06: related, not a mapping …and 7 more in the downloads
HIPAA	§164.308(a)(8)	Evaluation	Editorial	Same topic: Compliance (editorial pick) 35 loosely related (not mappings) §164.308(a)(7) Contingency Plan Loosely related Only shares CSF GV.OC-03, GV.OC-04, GV.PO-02: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping …and 27 more in the downloads
GDPR	Art.5(2)	Principles relating to processing of personal data	Editorial	Same topic: Compliance (editorial pick) 4 loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Art.28(3) Processor Loosely related Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Art.24(2) Responsibility of the controller Loosely related Only shares CSF GV.PO-02: related, not a mapping Art.32(1)(b) Security of processing Loosely related Only shares CSF GV.OC-04: related, not a mapping
NIS2	2.2 2.3 9.1	Compliance monitoring; Independent review of information and network security…	Crosswalk	Same topic: Compliance ENISA NIS2 → ISO 27001 mapping 5 loosely related (not mappings) 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-03, GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.OC-03, GV.PO-02: related, not a mapping 6.1 Security in acquisition of ICT services, ICT systems or ICT products Loosely related Only shares CSF GV.PO-02, GV.SC-06: related, not a mapping 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.OC-04: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-03: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(f)Art.6(6)Art.6(7)	Governance and organisation; ICT risk management framework…	Editorial	Same topic: Compliance (editorial pick) 17 loosely related (not mappings) Art.28(3) General principles Loosely related Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Art.28(4) General principles Loosely related Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Art.28(5) General principles Loosely related Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Art.28(8) General principles Loosely related Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Art.30(2) Key contractual provisions Loosely related Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Art.30(3) Key contractual provisions Loosely related Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Art.5(2)(b) Governance and organisation Loosely related Only shares CSF GV.PO-02: related, not a mapping Art.6(5) ICT risk management framework Loosely related Only shares CSF GV.PO-02: related, not a mapping …and 9 more in the downloads
CPS 234	Para 32 Para 33 Para 34	Internal audit reviews control design and effectiveness; Assurance provided by appropriately skilled personnel…	Editorial	Same topic: Compliance (editorial pick) 5 loosely related (not mappings) Para 16 Assess third parties' information security capability Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Para 22 Evaluate the design of third parties' controls Loosely related Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Para 28 Check third parties' control testing is adequate Loosely related Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Para 18 Maintain an information security policy framework Loosely related Only shares CSF GV.PO-02: related, not a mapping Para 19 Policies direct everyone with security obligations Loosely related Only shares CSF GV.PO-02: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.