Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Control A.5.14Information transfer

What it means in practice

Information transfer rules, procedures or agreements must be in place for all types of transfer facilities within the organisation and between the organisation and other parties.

“All types” is doing the work: electronic transfer, physical media, and verbal transfer — a conversation in a public place is a transfer, and is the one no procedure covers.

For transfers to other parties, the control expects an agreement, which is where the confidentiality terms of A.6.6 and the supplier terms of A.5.20 meet a practical route for moving information. Ad hoc transfers are where data most often leaves in ways nobody sanctioned: a large file that would not fit an attachment, sent through a consumer service because the organisation provided no alternative.

The most effective implementations are not the strictest. They are the ones that provide a sanctioned route that is easier than the unsanctioned one, because a rule that makes the job harder is a rule people route around and then do not report.

How to put this in place

Information is often most exposed when it moves, by email, file link, courier or messaging app. Rules by method and classification stop people from improvising with sensitive material.

  1. List the ways information is transferred, including file-sharing links and messaging apps.
  2. Set the approved tools, encryption and permitted recipients for each classification level.
  3. Configure the tools to match, for example restrict external sharing by default.
  4. Put transfer terms into agreements with partners you exchange with regularly.
  5. Tell staff the rules and check a sample of transfers.

Evidence an auditor usually looks for: the transfer rules, tool settings such as email encryption and sharing restrictions, and agreements with regular exchange partners.

What is in the packs for this

Each one helps with this requirement.

  • Excel

    Annex A Control Implementation Library

    in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
  • Excel

    Statement of Applicability Template

    in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
  • Word

    Information Classification & Handling Policy

    in Information Classification & HandlingIts Framework References list this control. Supported by: Sharing outside the organisation and transfer (CL-08).
  • Excel

    Classification Level Handling Rules Matrix

    in Information Classification & HandlingIts Framework References list this control. Supported by: Handling matrix: Share externally and Transfer at each level.
  • Word

    Classification & Labelling Procedure

    in Information Classification & HandlingIts Framework References list this control. Supported by: Sharing outside the organisation in the worked example; the Confidential setup.
  • Word

    Bridge Letter & Management Response Templates

    in SOC 2 Report ReadinessIts Framework References list this control. Supported by: Information transfer: the steps for sending a report, and a letter, to a customer by a controlled route.