ISO 27001 A.5.10: Define Acceptable Use People Can Follow

What A.5.10 requires in practice

Annex A control A.5.10 asks the organisation to identify, document and implement two things for information and other associated assets: rules for acceptable use, and procedures for handling. The first says what people may and may not do with the assets. The second explains how to treat information at each stage, for example when storing, sending, copying or discarding it.

All three verbs carry weight. Identify means working out where rules are needed. Document means writing them in a form people can find. Implement means they are actually applied and understood, not just filed. The rules should reflect the organisation’s classification and the risks of the assets involved.

The control does not require a single document called an acceptable use policy; the content can sit in several places. It also does not set the rules themselves. The organisation decides what is sensible for its business, such as personal use of devices, handling of customer data or use of removable media.

Describe permitted work as clearly as prohibited work

A rule is easier to follow when it identifies the approved route for a legitimate task. If staff need to exchange large files, collaborate with suppliers or work away from the office, explain which arrangements they may use and how to request a different option. A prohibition without a viable alternative can encourage hidden workarounds.

Consider behaviour and information handling together. The same device may be appropriate for one activity and unsuitable for another because of the information involved. Connect the rules to classification rather than treating every file and every service as interchangeable.

Follow copies through their working life

Information often leaves its original controlled location during ordinary work. Staff may export a report, print a drawing, create a temporary extract or send a copy for review. Define how protection continues through those steps and how information is returned, retained or deleted when the task ends.

Include services the organisation does not own. A public cloud tool, customer portal or personal device can still process its information. Permission to use a tool should consider the proposed use and relevant agreements, rather than depend on whether an employee can create an account. Connect approved service use with cloud-service management where applicable.

Make uncertain cases easy to resolve

New working methods will arise faster than a policy can name every product. Give employees a route to ask whether a proposed use is acceptable and identify who can decide. The decision should consider the information, recipients, service conditions and business need. Record significant exceptions and reconsider recurring ones.

If monitoring is part of the arrangement, explain it accurately and handle applicable requirements through competent review. Do not imply that possession of a company device gives unlimited authority to inspect every personal activity. Security expectations and monitoring practices need to be clear, proportionate and consistent with the organisation’s obligations.

Why acceptable use matters to the business

Many incidents begin with ordinary people making reasonable but unsafe choices because nobody told them what was expected. Clear rules for use and handling reduce that risk, protect customer information and give managers a fair basis for correcting behaviour.

Rules also protect the business in disputes, since it can show what staff and contractors were told. Rules that are unrealistic or ignored do the opposite and may encourage workarounds. The best results come when the rules are short, practical and tied to the way people actually work, so that following them is the easy option.

How to implement A.5.10

Write rules around real tasks and test that people can follow them. Short, specific and well-timed guidance generally works better than a long document read once during induction.

1. List the assets and situations where behaviour matters most, such as laptops, messaging tools, cloud storage and customer records.
2. Draft rules in plain language that say what is allowed, what is not and what to do when unsure.
3. Link handling rules to your classification scheme so people know how to treat information at each level.
4. Check feasibility with the teams who will apply them, adjusting where a rule blocks legitimate work.
5. Communicate the rules at onboarding and when they change, and make them easy to find.
6. Monitor adherence through sampling and incident reviews, and update rules in light of what you learn.
7. Revisit the rules after incidents or near misses to see whether they were clear, and correct the wording that caused confusion.

Evidence an auditor expects for A.5.10

Common nonconformities with A.5.10

Weaknesses commonly show rules that nobody can find or follow. Assessors typically test how well the rules are understood by asking ordinary staff, not only managers.

• Staff cannot say what rules apply to personal devices or sharing customer information.
• Rules exist but conflict with how the business actually works, so they are ignored.
• Handling procedures do not match the organisation’s classification of information.
• Contractors and temporary workers have not been given the rules.
• Rules for removable media or personal devices were written, but no one has checked whether they are followed.

Illustrative software example: a new online assistance tool

Illustrative construction example: shared printing at a project office

A hypothetical contractor uses a shared project-office printer for drawings and commercial documents. Staff routinely leave print jobs unattended because the acceptable-use rules discuss electronic files but say nothing about the actual printing arrangement. A review identifies a risk of exposing sensitive tender information.

The contractor establishes a usable handling method, explains it to project staff and checks real practice during busy periods. It also provides an alternative for material unsuitable for the shared arrangement. A policy signature would not have revealed whether the physical workflow could support the intended protection.

Test behaviour and deal with friction

Ask users to describe how they would complete a common task and an unusual one. Observe authorised work where appropriate and compare it with the rules. Look for confusing terms, inaccessible instructions and methods that no longer match the tools people use. Feedback is useful evidence about whether the rules can be implemented.

A.5.10 explicitly calls for documented rules and handling procedures, but it does not prescribe a document title or length. Evidence can include current rules, communication, approved alternatives, exception decisions and checks of application. Protect the evidence appropriately, especially where it contains personal or customer information.

Common failures include relying on a broad “business use only” statement, omitting temporary copies and treating contractor users differently without a reason. Another is enforcing rules inconsistently for senior staff. Align management behaviour and role-relevant learning so that people understand both the expectation and the available route.