# Clause 4.2.2: Legal and regulatory requirements

Run and maintain a process that finds, obtains access to and assesses the legal and regulatory requirements applying to the continuity of the organization's products, services, activities and resources, ensure those requirements are reflected in how the BCMS is built and run, and keep that information documented and current.

Cloud: Outsourcing rules, sector resilience requirements and data location law all attach to cloud use, and they differ by market and by the data you hold. Capture the obligation and the clause it comes from, not a summary, so the legal team can test it against the contract.

Evidence: Documented process for identifying and assessing continuity related legal and regulatory requirements; Current obligations register with source, applicability and assessment date; Traceability from an obligation to the BCMS element that satisfies it; Evidence of horizon scanning or subscription to a legal update source.

Test: For each cloud service, record the outsourcing or resilience rule that applies and its citation.

Citation: ISO 22301:2019, clause 4.2.2. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.