What type of legislation requires a proper controlled purchase process?

A proper controlled purchase process is most directly required by Intellectual Property Rights (IPR) legislation. This type of legislation, which includes copyright, patent, and trademark laws, governs the legal use of products like software, digital media, and proprietary information. A controlled purchasing process is a fundamental organizational procedure to ensure that all acquired assets are legitimate, properly licensed, and used in accordance with legal terms. This prevents the inadvertent or deliberate use of pirated software or unlicensed content, thereby ensuring compliance with IPR laws. The ISO 27001 framework explicitly addresses this in its controls, linking procedural compliance directly to IPR.

A. Personal data protection act: This legislation governs the processing and protection of personal data, not the internal procurement procedures for acquiring assets like software.
B. Computer criminality act: These laws focus on penalizing illegal activities such as hacking and unauthorized access, rather than mandating internal corporate purchasing controls.
C. Government information act: This type of act typically relates to public access to government-held information and does not regulate the purchasing processes of private organizations.

1. ISO/IEC 27001:2013, Information technology — Security techniques — Information security management systems — Requirements.

Reference: Annex A, Control A.18.1.2 "Intellectual property rights (IPR)".

Content: This control objective states, "Appropriate procedures shall be implemented to ensure compliance with legal, regulatory and contractual requirements related to intellectual property rights and use of proprietary software products." A controlled purchase process is a primary example of such a procedure.

2. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Reference: Chapter 18, Section on "A.18.1.2 Intellectual property rights".

Content: The text explains that to comply with this control, organizations must have procedures for managing software assets, including "controls over the acquisition, installation, and use of software." This directly links a controlled acquisition (purchase) process to IPR compliance.

3. University of California, Berkeley - Information Security and Policy.

Reference: "Software and Copyrights" Policy Document.

Content: University policies on software acquisition routinely mandate purchasing through official channels to ensure license compliance. For example, such policies state that all software must be legally acquired and used in strict accordance with license agreements to avoid copyright infringement, demonstrating the direct link between purchasing controls and IPR law. (This is a representative example of university courseware and policy principles).