Intellectual property rights

What the requirement asks

Suitable procedures are to be put in place to protect intellectual property rights. Purpose: comply with the legal, regulatory and contractual requirements concerning intellectual property and the use of proprietary products. Guidance: to protect anything that can count as intellectual property, consider a topic-specific policy on intellectual property protection, communicated to those it concerns; publishing compliance procedures that define lawful use of software and information products; buying software only from known, reputable sources so copyright is not infringed; keeping asset registers that flag every asset with intellectual property protection needs; keeping proof of ownership of licences, manuals and similar; ensuring licence limits on users or resources such as CPUs are not exceeded; checking installations so that nothing unlicensed or unapproved is present; procedures to keep licence conditions met; procedures for getting rid of software or handing it on; respecting the conditions attached to software and content taken from public networks or other outside sources; not duplicating, converting or extracting from commercial audio or video recordings beyond what copyright law or licences allow; and not reproducing all or part of published works such as standards, books, papers or reports beyond what copyright or licences permit. Other information: intellectual property covers copyright in software and documents, designs, trade marks, patents and licences to source code; proprietary software licences commonly restrict use to named machines or limit copying to backups (see ISO/IEC 19770); data acquired from outside is normally covered by a data sharing agreement that should state permitted processing and provenance (ISO/IEC 23751); infringement can bring fines and criminal proceedings; and the risk of staff or third parties failing to respect the organization's own intellectual property should also be managed. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Intellectual property needs a route for licences, open source and third-party content. The guidance asks for the inventory, the approval and the evidence of compliance.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the topic-specific intellectual property policy and compliance procedures for use of software and information products and one live sample together.

Evidence an assessor asks for

• Software licensingThe topic-specific intellectual property policy and compliance procedures for use of software and information products
• Software licensingA software asset register flagging assets with intellectual property requirements and linked proof of licence ownership
• Software licensingLicence compliance reviews reconciling installed software and resource usage (users, CPUs) against entitlements
• Software licensingApproved software sources and purchasing records showing acquisition from reputable suppliers
• Software licensingData sharing agreements for externally acquired data stating permitted processing and provenance
• Software licensingProcedures for retiring software or handing licences on to another party

The question an assessor will ask

An assessor will ask for the topic-specific intellectual property policy and compliance procedures for use of software and information products, then trace it to the system it protects. For A.5.32 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Licence counts are exceeded in virtualized or cloud environments where CPU-based licensing applies
• Users install software from unvetted sources
• Copyrighted documents such as standards are shared internally beyond the licence terms
• The organization's own intellectual property is not protected in contracts with staff and third parties

Before the next audit

Before the next audit, check one live sample for this gap: licence counts are exceeded in virtualized or cloud environments where cpu-based licensing applies.