Identification of Applicable Legislation. Supplier shall explicitly define, document, and maintain all relevant statutory, regulatory, and contractual requirements for each information system type. The specific controls and individual responsibilities to meet these requirements shall be similarly defined and documented and then communicated to the user community through a documented security training and awareness program.
