ISO 27002:2022 – Control 5.14 – Information Transfer

Purpose of Control 5.14

Control 5.14 is a preventive type of control that requires organisations to put in place appropriate rules, procedures, and/or agreements to maintain the security of data when it is shared within an organisation or when transmitted to third parties.

Attributes of Control 5.14

Ownership of Control 5.14

While the development and implementation of rules, procedures, and agreements require the support and approval of high-level management, the cooperation and expertise of different stakeholders within an organisation, including the legal team, IT staff, and upper management, is of critical importance.

For instance, the legal team should ensure that the organisation enters into transfer agreements with third parties and that these agreements are in line with the requirements specified in Control 5.14. Likewise, the IT team should take an active part in defining and implementing controls to maintain the security of data as set out in 5.14.

General Guidance on Control 5.14

Compliance with 5.14 entails the development of rules, procedures, and agreements, including a topic-specific information transfer policy, that provides data in transit with a level of protection appropriate to the classification assigned to that information.

In other words, the level of protection should match the level of criticality and sensitivity of information transmitted.

Furthermore, Control 5.14 specifies that organisations must sign transfer agreements with recipient third parties to guarantee secure transmission of data.

Control 5.14 groups the types of transfer into three categories:

• Electronic transfer
• Physical storage media transfer
• Verbal transfer

Before, moving on to describe the specific requirements for each type of transfer, Control 5.14 lists the elements that must be included in all rules, procedures, and agreements for all three types of transfers in general:

• Organisations must define controls appropriate to the level of classification of the information to protect the information in transit from unauthorised access, modification, interception, copying, destruction, and denial-of-service attacks.
• An organisation must keep control over the chain of custody while it is in transit and must define and implement controls to ensure traceability of information.
• Relevant parties involved in the transfer of information should be defined and their contact details should be provided. This may include information owners and security officers.
• Allocation of liabilities in case a data breach occurs.
• Using a labeling system.
• Ensuring the availability of the transfer service.
• Creating topic-specific guidelines on the information transfer methods.
• Guidelines for storage and deletion of all business records, including messages.
• Analysis of the impact any applicable laws, regulations, or other obligations may have over the transfer.

Supplementary Guidance on Electronic Transfer

After listing the minimum content requirements for rules, procedures, and agreements common across all three types of transfer, Control 5.14 lists specific content requirements for each type of transfer.

Rules, agreements, and procedures should address the following issues when information is transferred electronically:

• Detection and prevention of malware attacks.
• Protecting sensitive information contained in the attachments transferred.
• Ensuring that all communications are sent to the correct recipients and the risk of sending communications to wrong email addresses, addresses, or phone numbers is eliminated.
• Obtaining prior authorization before starting to use any public communication services.
• Implementing stricter authentication methods when data is transmitted via public networks.
• Imposing restrictions on the use of e-communication services such as banning automatic forwarding.
• Advise personnel on not using short message or instant message services to share sensitive data because this content may be seen by unauthorised individuals in public spaces.
• Advising staff and other relevant parties on the security risks presented by fax machines such as the risk of unauthorised access or re-routing of messages to specific numbers.

Supplementary Guidance on Physical Storage Media Transfer

When information is shared via physical means such as papers, the rules, procedures, and agreements should cover the following:

• Assignment of responsibilities for notification of transmission, dispatch, and receipt.
• Ensuring correct addressing and transportation of the message.
• Packaging eliminates the risk of damage to the contents that may arise when the content is in transit. For instance, packaging should be good enough to not be affected by heat or moisture.
• A list of reliable couriers agreed and authorised by the management.
• Description of courier identification standards.
• Use of tamper-resistant controls such as bags if the level of sensitivity and criticality of information demands it.
• Procedures to verify IDs of couriers.
• Approved list of third parties providing transportation or courier services depending on the level of classification.
• Keeping log records of the time of delivery, list of authorised recipients, protections applied, and receipt at the destination.

Supplementary Guidance on Verbal Transfer

Control 5.14 states that when personnel exchange information within the organisation or when they transmit data to external parties, they should be informed of the following risks:

• They should avoid having confidential conversations over insecure public channels or in public spaces.
• They should not leave voice messages that contain confidential information considering the risk of replay by unauthorised persons and the risk of re-routing of the message to third parties.
• Each individual, whether employees or other relevant third parties, should be screened before being allowed in to listen to conversations.
• Rooms, where confidential conversations take place, should be equipped with appropriate controls such as sound-proofing.
• They should give a disclaimer before having any sensitive conversation.

Changes and Differences From ISO 27002:2013

27002:2022/5.14 replaces 27002:2013/(13.2.1, 13.2.2. 13.2.3).

While the two controls are similar to some extent, two key differences make the 2022 version’s requirements more onerou.

Specific Requirements for Electric, Physical and Verbal Transfers

In the 2013 version, section 13.2.3 addressed the specific requirements for the transfer of information via electronic messaging.

However, it did not separately address the transfer of information via verbal or physical manner.

In contrast, the 2022 version clearly identifies three types of information transfer and then sets out the content requirements for each of them separately.

2022 Version Sets Stricter Requirements for Electronic Transfer

While section 13.2.3 contained specific requirements for the content of agreements for electronic messaging, the 2022 Version imposes stricter obligations on organisations.

The 2022 Version requires organisations to describe and implement new controls in the rules, procedures, and agreements for electronic transfers.

For instance, organisations should advise their employees not to use SMS services when they include sensitive information.

More Detailed Requirements for Physical Transfers

The 2022 version sets more stringent requirements on the physical storage media transfer. For instance, its requirements are more comprehensive in respect of authentication of couriers and the types of damages that should be prevented.

Structural Changes

In the 2013 version, there was an explicit reference to specific requirements for agreements for information transfers. However, the ‘Rules’ and ‘Procedures’ were not addressed specifically.

In contrast, the 2022 version sets out the specific requirements for each of these three mechanisms.

New ISO 27002 Controls

How ISMS.online Helps

ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process, from defining the scope of your ISMS through risk identification and control implementation.

Get in touch today to book a demo.