What it asks for. Identify, document and keep current the legal, statutory, regulatory and contractual requirements relevant to information security, and the organisation's approach to meeting them.
In practice. A maintained register lists the applicable obligations, for example data protection law, sector rules such as NIS2 or DORA where relevant, export and cryptography restrictions, and security commitments made in customer contracts. Each entry has an owner and links to the controls that address it, and the register is reviewed when laws, markets or contracts change. Legal or compliance input is evident. Auditors expect the register, evidence of periodic review and a traceable link from obligations to policies and controls.
Common gaps. Registers are often created once for certification and never updated as new regulations or customer terms appear. Contractual security commitments, especially those agreed by sales, are frequently missing from the list altogether.