| 💼 A.18.1 Compliance with legal and contractual requirements | 5 | | | |
| 💼 A.18.1.1 Identification of applicable legislation and contractual requirements | | | | |
| 💼 A.18.1.2 Intellectual property rights | | | | |
| 💼 A.18.1.3 Protection of records | | 2 | 2 | |
| 💼 A.18.1.4 Privacy and protection of personally identifiable information | | | | |
| 💼 A.18.1.5 Regulation of cryptographic controls | | | | |
| 💼 A.18.2 Information security reviews | 3 | | | |
| 💼 A.18.2.1 Independent review of information security | | | | |
| 💼 A.18.2.2 Compliance with security policies and standards | | | | |
| 💼 A.18.2.3 Technical compliance review | | | | |