Control A.5.32Intellectual property rights
The organisation must implement appropriate procedures to protect intellectual property rights.
Two directions, and organisations usually attend to one. Protecting the organisation’s own intellectual property overlaps with classification, access control and A.8.4’s restrictions on source code. Respecting others’ rights is the half that generates the exposure: unlicensed software, licence terms exceeded, and open source components used in ways their licences do not permit.
The open source dimension is where this control has changed most. Software assembled from dependencies inherits their licence obligations, and an organisation that distributes a product without knowing what is in it cannot know what those obligations are — which is the same visibility problem A.5.21 raises for supply chain security, with a legal consequence instead of a security one.
The practical implementation is an inventory of what is used and under what terms, and a review point in development and procurement rather than a policy statement.
How to put this in place
Unlicensed software and misused content create legal and financial exposure. The ISMS should show that licences are tracked and rules exist for code and content.
- Track software licences against installations and cloud subscriptions.
- Set rules on open-source licences for code you ship.
- Set rules on copying third-party content.
- Reconcile licences with the inventory on a schedule.
- Remove or license any unlicensed copies found.
Evidence an auditor usually looks for: licence records reconciled with the inventory, the open-source policy and scan results where you develop software.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.