Control A.5.14Information transfer
Information transfer rules, procedures or agreements must be in place for all types of transfer facilities within the organisation and between the organisation and other parties.
“All types” is doing the work: electronic transfer, physical media, and verbal transfer — a conversation in a public place is a transfer, and is the one no procedure covers.
For transfers to other parties, the control expects an agreement, which is where the confidentiality terms of A.6.6 and the supplier terms of A.5.20 meet a practical route for moving information. Ad hoc transfers are where data most often leaves in ways nobody sanctioned: a large file that would not fit an attachment, sent through a consumer service because the organisation provided no alternative.
The most effective implementations are not the strictest. They are the ones that provide a sanctioned route that is easier than the unsanctioned one, because a rule that makes the job harder is a rule people route around and then do not report.
How to put this in place
Information is often most exposed when it moves, by email, file link, courier or messaging app. Rules by method and classification stop people from improvising with sensitive material.
- List the ways information is transferred, including file-sharing links and messaging apps.
- Set the approved tools, encryption and permitted recipients for each classification level.
- Configure the tools to match, for example restrict external sharing by default.
- Put transfer terms into agreements with partners you exchange with regularly.
- Tell staff the rules and check a sample of transfers.
Evidence an auditor usually looks for: the transfer rules, tool settings such as email encryption and sharing restrictions, and agreements with regular exchange partners.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.