Information transfer
Every kind of transfer facility, whether used inside the organization or with outside parties, is to be covered by rules, procedures or agreements for moving information.
What the requirement asks
Every kind of transfer facility, whether used inside the organization or with outside parties, is to be covered by rules, procedures or agreements for moving information. Purpose: keep information secure while it moves internally and to or from any external interested party. Guidance: a topic-specific transfer policy is set and shared with relevant parties; protection in transit reflects the classification of what is moved, and exchanges with third parties are governed by maintained transfer agreements that include authenticating the recipient (5.10). Transfer may be electronic, by physical media or spoken. For all forms the arrangements address: protection against interception, unauthorized access, copying, alteration, misdirection, destruction and denial of service, with access levels suited to the classification and extra measures such as encryption (8.24) for sensitive material; traceability and non-repudiation including chain of custody in transit; named contacts (owners, risk owners, security officers, custodians); incident responsibilities and liabilities, for instance lost media; an agreed, instantly understood labelling system (5.13); how dependable and available the transfer service is; acceptable use of transfer facilities (5.10); retention and disposal of business records including messages, noting local law; and other legal and contractual needs such as electronic signatures (5.31 to 5.34). Electronic transfer adds malware defence (8.7), protecting sensitive attachments, stopping misaddressed messages, approval before using public messaging, social, file-sharing or cloud services, stronger authentication over public networks, restrictions such as blocking automatic forwarding to external mail, advice against putting critical content in SMS or instant messages, and warnings about fax message stores and mis-programmed numbers. Physical media transfer adds responsibility for controlling and notifying dispatch and receipt, correct addressing, protective packaging per manufacturer guidance against heat, moisture and magnetic fields with minimum standards such as opaque envelopes, management-approved reliable couriers with identification standards and verification, tamper-evident or tamper-resistant containers by classification, approved transport providers by classification, and logs of content, protection, authorized recipients, handover and arrival times. Verbal transfer: remind people not to hold confidential conversations in public or on insecure channels, not to leave confidential voicemail, to ensure listeners are cleared to the right level, to use suitable rooms (closed doors, sound-proofing) and to open sensitive discussions by stating the classification and handling rules. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.
What the guidance adds
Information transfer covers the route as well as the content. The guidance asks for the rules by channel, the approval for exceptional transfers and the record that the transfer happened as intended.
Status of the guidance. The guidance lens for 5.14 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the topic-specific information transfer policy and its communication record and one live sample together.
Evidence an assessor asks for
- Information transferThe topic-specific information transfer policy and its communication record
- Information transferTransfer agreements with third parties covering recipient authentication, protection levels, incident liability and labelling
- Information transferEmail and messaging configurations such as encryption of sensitive attachments, blocking of automatic external forwarding and approval rules for public file-sharing or cloud services
- Information transferApproved courier and transport provider lists with identification and verification procedures
- Information transferMedia transfer logs recording contents, protection applied, authorized recipients and handover and receipt times
- Information transferAwareness material on verbal transfer, voicemail and messaging of confidential information
The question an assessor will ask
An assessor will ask for the topic-specific information transfer policy and its communication record, then trace it to the system it protects. For A.5.14 the test is whether that record ties to a live sample, not whether the control is named in a policy.
Common gaps
- Automatic forwarding of email to personal external accounts is not blocked
- Staff use unapproved consumer file-sharing tools to send sensitive files
- Physical media is shipped without tamper-evident packaging or chain-of-custody records
- No agreement exists with partners who routinely exchange sensitive data
Before the next audit
Before the next audit, check one live sample for this gap: automatic forwarding of email to personal external accounts is not blocked.