Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Control A.5.10Acceptable use of information and other associated assets

What it means in practice

Rules for the acceptable use of information and other associated assets, and procedures for handling them, must be identified, documented and implemented.

Two halves, and the second is the substantive one. Acceptable use is the familiar statement of what people may and may not do. Handling procedures are the practical instructions attached to each classification level from A.5.12 — how information at that level may be stored, transmitted, printed, shared externally and destroyed.

Without the handling procedures, a classification scheme labels information and changes no behaviour. The label says “confidential” and nobody has been told what that requires of them, so the rules are applied by intuition and inconsistently.

The other frequent gap is scope. Acceptable use written for employees leaves contractors, temporary staff and supplier personnel covered by a contract clause that refers to a policy they have never seen — which A.6.2 and A.5.20 are supposed to close and often do not.

How to put this in place

People cannot follow rules they have not been told. A clear acceptable use policy gives you something to point to when equipment or information is misused.

  1. Decide the areas to cover: email, internet, devices, cloud tools and personal use.
  2. Write the rules in plain words that people can actually follow.
  3. Align the wording with your classification and handling rules; if those are not written yet, do A.5.12 first or revisit this policy afterwards.
  4. Have employees and contractors acknowledge it on joining and once a year.
  5. Record exceptions and review the policy at least yearly.

Evidence an auditor usually looks for: the approved policy and acknowledgement records for a sample of staff and contractors.

What is in the packs for this

Each one helps with this requirement.

  • Excel

    Annex A Control Implementation Library

    in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
  • Excel

    Statement of Applicability Template

    in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
  • Excel

    Mandatory ISMS Documentation Checklist

    in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists rules for acceptable use among the documents auditors commonly expect for this control.
  • Word

    Information Classification & Handling Policy

    in Information Classification & HandlingIts Framework References list this control. Supported by: Handling at each level; CL-06, CL-08, CL-19.
  • Word

    Classification Quick-Reference Card & Staff Briefing

    in Information Classification & HandlingIts Framework References list this control. Supported by: The card's rows on Confidential, AI tools and throwing away.
  • Word

    AI Acceptable Use & Security Policy

    in AI Security Governance & Acceptable UseIts Framework References list this control. Supported by: The whole policy: rules for the acceptable use of information and of AI tools.
  • Excel

    AI Tool Approval & Data Permission Matrix

    in AI Security Governance & Acceptable UseIts Framework References list this control. Supported by: Approved Tools and Data Rules: the rules for the acceptable use of information and other assets when an AI tool is used.