ORP.5 Compliance Management

All statutory, contractual, and additional provisions that affect information security management MUST be identified and documented. The statutory, contractual, and additional provisions that are relevant to an organisation's individual departments SHOULD be presented in detail in a structured overview. This documentation MUST be kept up to date.

Requirements identified as security-relevant MUST be incorporated when planning and designing business processes, applications, and IT systems, and when acquiring new components.

Managers who have a statutory responsibility for their organisation MUST ensure its compliance with statutory, contractual, and additional requirements. The responsibilities and authorities regarding compliance with these provisions MUST be defined.

Suitable safeguards MUST be identified and implemented in order to prevent violations of relevant requirements. If violations are identified, appropriate corrective measures MUST be taken in order to ensure compliance.

A process for identifying all relevant statutory, contractual, and additional provisions that impact information security management MUST be established within organisations. Suitable processes and organisational structures SHOULD be established to ensure an overview of the various statutory requirements for the individual areas of a given organisation based on its identification of and compliance with the legal framework at hand. Persons responsible for compliance management SHOULD be appointed for this purpose.

An organisation's Compliance Manager and Chief Information Security Officer (CISO) SHOULD exchange information on a regular basis. They SHOULD integrate security requirements into compliance management, translate security-related requirements into security safeguards, and monitor their implementation together.

If it is necessary to deviate from regulations in a particular case, the exception SHOULD be justified and approved by an authorised body after a risk assessment. There SHOULD be an approval procedure for granting exceptions. An overview of all exemptions granted SHOULD be established and maintained. An appropriate procedure for documentation and a corresponding review process SHOULD be established. All exceptions SHOULD be granted for a limited period.

A procedure SHOULD be established for regular checking of the efficiency and effectiveness of compliance management and the resulting requirements and safeguards (see also DER.3.1 Audits and Revisions). Regular examination of whether a given organisational structure and processes for compliance management are appropriate SHOULD be carried out.