Control A.5.10Acceptable use of information and other associated assets
Rules for the acceptable use of information and other associated assets, and procedures for handling them, must be identified, documented and implemented.
Two halves, and the second is the substantive one. Acceptable use is the familiar statement of what people may and may not do. Handling procedures are the practical instructions attached to each classification level from A.5.12 — how information at that level may be stored, transmitted, printed, shared externally and destroyed.
Without the handling procedures, a classification scheme labels information and changes no behaviour. The label says “confidential” and nobody has been told what that requires of them, so the rules are applied by intuition and inconsistently.
The other frequent gap is scope. Acceptable use written for employees leaves contractors, temporary staff and supplier personnel covered by a contract clause that refers to a policy they have never seen — which A.6.2 and A.5.20 are supposed to close and often do not.
How to put this in place
People cannot follow rules they have not been told. A clear acceptable use policy gives you something to point to when equipment or information is misused.
- Decide the areas to cover: email, internet, devices, cloud tools and personal use.
- Write the rules in plain words that people can actually follow.
- Align the wording with your classification and handling rules; if those are not written yet, do A.5.12 first or revisit this policy afterwards.
- Have employees and contractors acknowledge it on joining and once a year.
- Record exceptions and review the policy at least yearly.
Evidence an auditor usually looks for: the approved policy and acknowledgement records for a sample of staff and contractors.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists rules for acceptable use among the documents auditors commonly expect for this control.