All 93 controls · Organizational controls
Control 5.32
Intellectual property rights
What ISO/IEC 27002:2022 control 5.32 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Suitable procedures are to be put in place to protect intellectual property rights. Purpose: comply with the legal, regulatory and contractual requirements concerning intellectual property and the use of proprietary products. Guidance: to protect anything that can count as intellectual property, consider a topic-specific policy on intellectual property protection, communicated to those it concerns; publishing compliance procedures that define lawful use of software and information products; buying software only from known, reputable sources so copyright is not infringed; keeping asset registers that flag every asset with intellectual property protection needs; keeping proof of ownership of licences, manuals and similar; ensuring licence limits on users or resources such as CPUs are not exceeded; checking installations so that nothing unlicensed or unapproved is present; procedures to keep licence conditions met; procedures for getting rid of software or handing it on; respecting the conditions attached to software and content taken from public networks or other outside sources; not duplicating, converting or extracting from commercial audio or video recordings beyond what copyright law or licences allow; and not reproducing all or part of published works such as standards, books, papers or reports beyond what copyright or licences permit. Other information: intellectual property covers copyright in software and documents, designs, trade marks, patents and licences to source code; proprietary software licences commonly restrict use to named machines or limit copying to backups (see ISO/IEC 19770); data acquired from outside is normally covered by a data sharing agreement that should state permitted processing and provenance (ISO/IEC 23751); infringement can bring fines and criminal proceedings; and the risk of staff or third parties failing to respect the organization's own intellectual property should also be managed.
Purpose in the standard’s terms, in our words: Ensures compliance with requirements on intellectual property rights and the use of proprietary products.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Identify; Legal and compliance; Governance and ecosystem.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Identify |
| Operational capabilities | Legal and compliance |
| Security domains | Governance and ecosystem |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- The topic-specific intellectual property policy and compliance procedures for use of software and information products
- A software asset register flagging assets with intellectual property requirements and linked proof of licence ownership
- Licence compliance reviews reconciling installed software and resource usage (users, CPUs) against entitlements
- Approved software sources and purchasing records showing acquisition from reputable suppliers
- Data sharing agreements for externally acquired data stating permitted processing and provenance
- Procedures for retiring software or handing licences on to another party
Where audits commonly find gaps
- Licence counts are exceeded in virtualized or cloud environments where CPU-based licensing applies
- Users install software from unvetted sources
- Copyrighted documents such as standards are shared internally beyond the licence terms
- The organization's own intellectual property is not protected in contracts with staff and third parties
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (18.1.2) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.