Information transfer

What the control asks

Every kind of transfer facility, whether used inside the organization or with outside parties, is to be covered by rules, procedures or agreements for moving information. Purpose: keep information secure while it moves internally and to or from any external interested party. Guidance: a topic-specific transfer policy is set and shared with relevant parties; protection in transit reflects the classification of what is moved, and exchanges with third parties are governed by maintained transfer agreements that include authenticating the recipient (5.10). Transfer may be electronic, by physical media or spoken. For all forms the arrangements address: protection against interception, unauthorized access, copying, alteration, misdirection, destruction and denial of service, with access levels suited to the classification and extra measures such as encryption (8.24) for sensitive material; traceability and non-repudiation including chain of custody in transit; named contacts (owners, risk owners, security officers, custodians); incident responsibilities and liabilities, for instance lost media; an agreed, instantly understood labelling system (5.13); how dependable and available the transfer service is; acceptable use of transfer facilities (5.10); retention and disposal of business records including messages, noting local law; and other legal and contractual needs such as electronic signatures (5.31 to 5.34). Electronic transfer adds malware defence (8.7), protecting sensitive attachments, stopping misaddressed messages, approval before using public messaging, social, file-sharing or cloud services, stronger authentication over public networks, restrictions such as blocking automatic forwarding to external mail, advice against putting critical content in SMS or instant messages, and warnings about fax message stores and mis-programmed numbers. Physical media transfer adds responsibility for controlling and notifying dispatch and receipt, correct addressing, protective packaging per manufacturer guidance against heat, moisture and magnetic fields with minimum standards such as opaque envelopes, management-approved reliable couriers with identification standards and verification, tamper-evident or tamper-resistant containers by classification, approved transport providers by classification, and logs of content, protection, authorized recipients, handover and arrival times. Verbal transfer: remind people not to hold confidential conversations in public or on insecure channels, not to leave confidential voicemail, to ensure listeners are cleared to the right level, to use suitable rooms (closed doors, sound-proofing) and to open sensitive discussions by stating the classification and handling rules.

Purpose in the standard’s terms, in our words: Keeps information secure when it is moved within the organization or exchanged with external parties.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Asset management, Information protection; Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• The topic-specific information transfer policy and its communication record
• Transfer agreements with third parties covering recipient authentication, protection levels, incident liability and labelling
• Email and messaging configurations such as encryption of sensitive attachments, blocking of automatic external forwarding and approval rules for public file-sharing or cloud services
• Approved courier and transport provider lists with identification and verification procedures
• Media transfer logs recording contents, protection applied, authorized recipients and handover and receipt times
• Awareness material on verbal transfer, voicemail and messaging of confidential information

Where audits commonly find gaps

• Automatic forwarding of email to personal external accounts is not blocked
• Staff use unapproved consumer file-sharing tools to send sensitive files
• Physical media is shipped without tamper-evident packaging or chain-of-custody records
• No agreement exists with partners who routinely exchange sensitive data

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (13.2.1, 13.2.2) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.10 Acceptable use of information and other associated assets
• 5.11 Return of assets
• 5.13 Labelling of information

Read the five attributes All 93 controls