Legal and regulatory requirements

What the baseline asks

Run and maintain a process that finds, obtains access to and assesses the legal and regulatory requirements applying to the continuity of the organization's products, services, activities and resources, ensure those requirements are reflected in how the BCMS is built and run, and keep that information documented and current.

What it means when the service runs in the cloud

Outsourcing rules, sector resilience requirements and data location law all attach to cloud use, and they differ by market and by the data you hold. Capture the obligation and the clause it comes from, not a summary, so the legal team can test it against the contract.

Evidence an auditor or a customer asks for

• Documented process for identifying and assessing continuity related legal and regulatory requirements
• Current obligations register with source, applicability and assessment date
• Traceability from an obligation to the BCMS element that satisfies it
• Evidence of horizon scanning or subscription to a legal update source

Common gaps in a cloud estate

• Obligations register held by legal and never reconciled against the BCMS
• No assessment step, so the register lists laws without saying what they demand of continuity
• Regime changes in new operating jurisdictions missed because the process has no trigger

Done well, what the file shows

Done well, this clause leaves a documented process for identifying and assessing continuity related legal and regulatory requirements that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.

A test you can run this month

For each cloud service, record the outsourcing or resilience rule that applies and its citation.