The draft is international guidance. The obligation to hold an ISMS usually comes from somewhere else: a regulator, a customer or a law. These are the held frameworks that matter to this buyer in the four markets, in the order we scan them. The ISO guidance is not a substitute for any of them.
United States
SEC cyber incident disclosure rules for public companies, the FTC Safeguards Rule for financial institutions, HIPAA for health data and the NIST Cybersecurity Framework as the common reference. A US buyer usually needs the ISMS to support one of these, not to stand alone.
European Union
NIS2 for essential and important entities, DORA for financial entities and their ICT providers, and the GDPR for personal data. The ISMS is the management system behind the evidence these regimes ask for.
United Kingdom
UK GDPR and the Data Protection Act, the FCA operational resilience rules for financial firms, and Cyber Essentials for the baseline. A UK buyer often needs the ISMS to satisfy a customer or a regulator, not only a certificate.
Australia
The Privacy Act and the Notifiable Data Breaches scheme, APRA CPS 234 for regulated financial entities, the Security of Critical Infrastructure Act and the ASD Essential Eight as the technical baseline. The ISMS is the governance layer above the technical controls.
Where a regime is not held in the record, this page names it and does not state its requirements. The register's requirement fields come from ISO/IEC 27001:2022. The laws above are context, not a second rule set.
Not legal advice. Check the current law and your regulator before relying on a control.