← ISO 27001 Annex A in plain English

A.5.31 A.5

Organizational / A.5.31

Identifying legal, regulatory, and contractual obligations

Think of it likeKnowing which permits the extension actually needs before building it.

In plain English

The family works out what the law, the contracts, and the regulators require of it, because an obligation nobody has identified is one nobody is meeting.

Related CSF and CIS controls (unofficial mapping)