ISO 27001 A.5.14: Protect Information in Transfer

What A.5.14 requires in practice

Annex A control A.5.14 asks for rules, procedures or agreements covering information transfer. They must exist for every type of transfer facility, whether the transfer stays within the organisation or goes to an outside party. Transfer is understood widely: email, file sharing, messaging, physical media, post, couriers, telephone calls and spoken conversations all count.

The control offers three routes: rules, procedures and agreements. Which fits depends on the situation. Internal transfers may be covered by rules and procedures staff follow. Transfers to customers, suppliers or partners are often better supported by an agreement that sets out expectations on both sides.

The control does not name methods such as encryption, nor fix a list of approved channels. The organisation decides what protection suits each type of transfer, reflecting the classification and sensitivity of the information. What matters is that every channel in real use has a defined and understood way of being used safely.

Understand the journey before approving the channel

Start with a real transaction. Identify what is sent, why the recipient needs it, who authorises the exchange and what could go wrong in transit or at handover. Confidential material may require protection against unintended disclosure; a production instruction also needs protection against alteration and late delivery. The consequences determine the controls.

Choose the minimum information required for the purpose. Confirm the recipient and destination independently when the consequence of misdirection warrants it. An address that looks familiar can still belong to the wrong project, tenant or person. Establish a practical escalation route when a destination changes unexpectedly.

Set expectations with external recipients. An agreement can address permitted use, onward transfer, protection, incident contact and return or retention arrangements where relevant. Its detail should follow the relationship and obligations. A long agreement that operational teams cannot apply is less useful than clear responsibilities supported by functioning methods.

Electronic transfers need more than encryption

Encryption protects particular parts of a transfer under particular conditions. It does not decide whether a recipient is authorised, whether a link is open too broadly or whether the uploaded file contains unnecessary information. Check the effective audience, access duration, recipient authentication and the process for withdrawing access when appropriate.

Consider failures as well as normal delivery. Staff need to recognise a rejected upload, suspicious destination change or accidental disclosure and know how to report it. Avoid workarounds that split large transfers across unapproved services. Connect the workflow with labelling and access rights, so that instructions remain meaningful after receipt.

Physical and verbal transfers deserve explicit decisions

For physical material, consider the route, packaging, custody, recipient verification and confirmation of receipt. The required detail depends on sensitivity, replaceability and business importance. A courier signature may confirm delivery to a building without confirming handover to an authorised person.

For sensitive conversations, choose an appropriate setting and audience. Check whether remote participants are in shared spaces, whether a room permits overhearing and whether recording is justified and controlled. A confidential discussion can be exposed even when no document moves. These decisions belong in usable staff guidance, including how to pause a conversation if its setting changes.

Why transferring information matters to the business

Information is most exposed when it moves: misdirected emails, unprotected attachments, lost media and casual conversations are everyday causes of leaks. Clear rules for each channel help people choose a safe route without having to improvise under time pressure.

For many businesses, transfers to customers and providers are where contractual and legal duties bite hardest. An agreed way of exchanging information avoids disputes about who was responsible if something goes wrong. It also reassures partners that the organisation controls what it sends. Unregulated channels, by contrast, tend to grow informally and are often discovered only after an incident.

How to implement A.5.14

Begin with how information really moves in your business, and then close the gaps between actual practice and agreed channels. Do not forget that the least formal channels, such as conversation and messaging, often hold the highest risk. Keep a note of the reasons for each choice.

1. Map the main transfers, including those to customers and suppliers, and note the channel used for each.
2. Group them by sensitivity, using your classification scheme to decide how much protection each deserves.
3. Define approved channels and handling rules for each group, in plain language people can follow.
4. Where information flows to another organisation regularly, agree expectations with them in writing.
5. Include less obvious channels such as personal messaging, physical media and spoken exchanges in the discussion.
6. Provide easy, approved alternatives so staff are not tempted to use unapproved tools for convenience.
7. Check transfers in practice through sampling and incident reviews, and adjust rules where a channel keeps failing.

Evidence an auditor expects for A.5.14

Common nonconformities with A.5.14

Weaknesses usually appear in the channels people use every day without a defined rule. Assessors usually test this control by following real exchanges rather than reading the rules alone.

• Staff send sensitive information through personal email or messaging tools that the rules do not cover.
• Regular exchanges with a supplier or customer are not backed by any agreed expectations.
• Physical transfers, such as media sent by courier, have no defined handling.
• Rules exist, but staff cannot say which channels are acceptable for different types of information.
• Agreements with external parties exist but do not reflect the sensitivity of what is actually exchanged.

Illustrative software example: the correct company, wrong workspace

Illustrative manufacturing example: technical records by courier

A hypothetical manufacturer sends original inspection records to a customer for a shipment dispute. The records are difficult to recreate and contain proprietary process details. Ordinary delivery tracking does not establish who can receive the package or what happens if delivery fails.

The parties agree a named receiving function, appropriate protective packaging and a fallback route for failed delivery. Dispatch and receipt records make custody visible, while an authorised retained copy supports continuity where permitted. The selected measures address confidentiality and availability without assuming that every paper transfer needs the same elaborate process.

Check the rules against actual transfers

Evidence can include transfer rules, relevant agreements, approved methods, sample authorisations and records proportionate to the risk. A.5.14 does not prescribe a universal transfer log for every conversation or file. Where traceability is needed, define what must be recorded and protect those records.

Common failures include approving a tool without configuring it, retaining shared links indefinitely, overlooking verbal disclosures and treating a partner’s preferred channel as automatically acceptable. Sample completed transfers and ask the sender and recipient what protection applied. Review significant changes to channels or relationships through supplier security arrangements.