Management systems ask you to know which obligations apply, and to keep that list current. A register is that list: not the law itself, but the obligations you have decided the organisation must follow.
What belongs on it
Each row needs a source specific enough that someone else can find the original text, and an owner who keeps the organisation’s response current.
- Legal. A law or statute, such as a data-protection act.
- Regulatory. A regulator or a scheme you have to satisfy.
- Contractual. A customer, supplier, or other agreement, such as a security schedule in a contract.
Why it is separate from controls
Controls describe what you do. The register describes what you must do, and where that duty comes from. How ISMSVision helps with legal requirements shows the product. The Legal requirements category explains the fields and the status.