ISO 27002:2022, Control 5.14 – Information Transfer

ISO 27002:2022 Revised Controls

Book a demo

female,specialist,works,on,desktop,computer,,project,manager,stands,beside

When information is transferred to internal or external parties, it creates a heightened risk to the confidentiality, integrity, availability, and security of information transmitted.

Control 5.14 entails the requirements that organisations must satisfy to maintain the security of data when it is shared internally or when it flows out of the organisation to third parties.

Purpose of Control 5.14

Control 5.14 is a preventive type of control that requires organisations to put in place appropriate rules, procedures, and/or agreements to maintain the security of data when it is shared within an organisation or when transmitted to third parties.

Attributes Table

Control TypeInformation Security PropertiesCybersecurity ConceptsOperational CapabilitiesSecurity Domains
#Preventive#Confidentiality
#Integrity
#Availability
#Protect#Asset Management
#Information Protection
#Protection

Ownership of Control 5.14

While the development and implementation of rules, procedures, and agreements require the support and approval of high-level management, the cooperation and expertise of different stakeholders within an organisation, including the legal team, IT staff, and upper management, is of critical importance.

For instance, the legal team should ensure that the organisation enters into transfer agreements with third parties and that these agreements are in line with the requirements specified in Control 5.14. Likewise, the IT team should take an active part in defining and implementing controls to maintain the security of data as set out in 5.14.

Get a Headstart on ISO 27001
  • All updated with the 2022 control set
  • Make 81% progress from the minute you log in
  • Simple and easy to use
Book your demo
img

General Guidance on Control 5.14

Compliance with 5.14 entails the development of rules, procedures, and agreements, including a topic-specific information transfer policy, that provides data in transit with a level of protection appropriate to the classification assigned to that information.

In other words, the level of protection should match the level of criticality and sensitivity of information transmitted.

Furthermore, Control 5.14 specifies that organisations must sign transfer agreements with recipient third parties to guarantee secure transmission of data.

Control 5.14 groups the types of transfer into three categories:

  • Electronic transfer
  • Physical storage media transfer
  • Verbal transfer

Before, moving on to describe the specific requirements for each type of transfer, Control 5.14 lists the elements that must be included in all rules, procedures, and agreements for all three types of transfers in general:

  • Organisations must define controls appropriate to the level of classification of the information to protect the information in transit from unauthorised access, modification, interception, copying, destruction, and denial-of-service attacks.
  • An organisation must keep control over the chain of custody while it is in transit and must define and implement controls to ensure traceability of information.
  • Relevant parties involved in the transfer of information should be defined and their contact details should be provided. This may include information owners and security officers.
  • Allocation of liabilities in case a data breach occurs.
  • Using a labeling system.

  • Ensuring the availability of the transfer service.
  • Creating topic-specific guidelines on the information transfer methods.
  • Guidelines for storage and deletion of all business records, including messages.

  • Analysis of the impact any applicable laws, regulations, or other obligations may have over the transfer.

Supplementary Guidance on Electronic Transfer

After listing the minimum content requirements for rules, procedures, and agreements common across all three types of transfer, Control 5.14 lists specific content requirements for each type of transfer.

Rules, agreements, and procedures should address the following issues when information is transferred electronically:

  • Detection and prevention of malware attacks.
  • Protecting sensitive information contained in the attachments transferred.
  • Ensuring that all communications are sent to the correct recipients and the risk of sending communications to wrong email addresses, addresses, or phone numbers is eliminated.
  • Obtaining prior authorization before starting to use any public communication services.

  • Implementing stricter authentication methods when data is transmitted via public networks.
  • Imposing restrictions on the use of e-communication services such as banning automatic forwarding.
  • Advise personnel on not using short message or instant message services to share sensitive data because this content may be seen by unauthorised individuals in public spaces.
  • Advising staff and other relevant parties on the security risks presented by fax machines such as the risk of unauthorised access or re-routing of messages to specific numbers.

Are you ready for
the new ISO 27002

We’ll give you an 81% headstart
from the moment you log in
Book your demo

We’re cost-effective and quick

Discover how that will boost your ROI
Get your quote

Supplementary Guidance on Physical Storage Media Transfer

When information is shared via physical means such as papers, the rules, procedures, and agreements should cover the following:

  • Assignment of responsibilities for notification of transmission, dispatch, and receipt.
  • Ensuring correct addressing and transportation of the message.
  • Packaging eliminates the risk of damage to the contents that may arise when the content is in transit. For instance, packaging should be good enough to not be affected by heat or moisture.
  • A list of reliable couriers agreed and authorised by the management.
  • Description of courier identification standards.
  • Use of tamper-resistant controls such as bags if the level of sensitivity and criticality of information demands it.
  • Procedures to verify IDs of couriers.
  • Approved list of third parties providing transportation or courier services depending on the level of classification.
  • Keeping log records of the time of delivery, list of authorised recipients, protections applied, and receipt at the destination.

Supplementary Guidance on Verbal Transfer

Control 5.14 states that when personnel exchange information within the organisation or when they transmit data to external parties, they should be informed of the following risks:

  • They should avoid having confidential conversations over insecure public channels or in public spaces.
  • They should not leave voice messages that contain confidential information considering the risk of replay by unauthorised persons and the risk of re-routing of the message to third parties.
  • Each individual, whether employees or other relevant third parties, should be screened before being allowed in to listen to conversations.
  • Rooms, where confidential conversations take place, should be equipped with appropriate controls such as sound-proofing.
  • They should give a disclaimer before having any sensitive conversation.

Changes and Differences From ISO 27002:2013

27002:2022/5.14 replaces 27002:2013/(13.2.1, 13.2.2. 13.2.3).

While the two controls are similar to some extent, two key differences make the 2022 version’s requirements more onerou.

Specific Requirements for Electric, Physical and Verbal Transfers

In the 2013 version, section 13.2.3 addressed the specific requirements for the transfer of information via electronic messaging.

However, it did not separately address the transfer of information via verbal or physical manner.

In contrast, the 2022 version clearly identifies three types of information transfer and then sets out the content requirements for each of them separately.

2022 Version Sets Stricter Requirements for Electronic Transfer

While section 13.2.3 contained specific requirements for the content of agreements for electronic messaging, the 2022 Version imposes stricter obligations on organisations.

The 2022 Version requires organisations to describe and implement new controls in the rules, procedures, and agreements for electronic transfers.

For instance, organisations should advise their employees not to use SMS services when they include sensitive information.

More Detailed Requirements for Physical Transfers

The 2022 version sets more stringent requirements on the physical storage media transfer. For instance, its requirements are more comprehensive in respect of authentication of couriers and the types of damages that should be prevented.

Structural Changes

In the 2013 version, there was an explicit reference to specific requirements for agreements for information transfers. However, the ‘Rules’ and ‘Procedures’ were not addressed specifically.

In contrast, the 2022 version sets out the specific requirements for each of these three mechanisms.

How ISMS.online Helps

ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process, from defining the scope of your ISMS through risk identification and control implementation.

Get in touch today to book a demo.

Get a Headstart
on ISO 27002

The only compliance
solution you need
Book your demo

New Controls

ISO/IEC 27002:2022 Control IdentifierISO/IEC 27002:2013 Control IdentifierControl Name
5.7NewThreat intelligence
5.23NewInformation security for use of cloud services
5.30NewICT readiness for business continuity
7.4NewPhysical security monitoring
8.9NewConfiguration management
8.10NewInformation deletion
8.11NewData masking
8.12NewData leakage prevention
8.16NewMonitoring activities
8.23NewWeb filtering
8.28NewSecure coding

Organisational Controls

ISO/IEC 27002:2022 Control IdentifierISO/IEC 27002:2013 Control IdentifierControl Name
5.105.1.1, 05.1.2Policies for information security
5.206.1.1Information security roles and responsibilities
5.306.1.2Segregation of duties
5.407.2.1Management responsibilities
5.506.1.3Contact with authorities
5.606.1.4Contact with special interest groups
5.7NewThreat intelligence
5.806.1.5, 14.1.1Information security in project management
5.908.1.1, 08.1.2Inventory of information and other associated assets
5.1008.1.3, 08.2.3Acceptable use of information and other associated assets
5.1108.1.4Return of assets
5.12 08.2.1Classification of information
5.1308.2.2Labelling of information
5.1413.2.1, 13.2.2, 13.2.3Information transfer
5.1509.1.1, 09.1.2Access control
5.1609.2.1Identity management
5.17 09.2.4, 09.3.1, 09.4.3Authentication information
5.1809.2.2, 09.2.5, 09.2.6Access rights
5.1915.1.1Information security in supplier relationships
5.2015.1.2Addressing information security within supplier agreements
5.2115.1.3Managing information security in the ICT supply chain
5.2215.2.1, 15.2.2Monitoring, review and change management of supplier services
5.23NewInformation security for use of cloud services
5.2416.1.1Information security incident management planning and preparation
5.2516.1.4Assessment and decision on information security events
5.2616.1.5Response to information security incidents
5.2716.1.6Learning from information security incidents
5.2816.1.7Collection of evidence
5.2917.1.1, 17.1.2, 17.1.3Information security during disruption
5.30NewICT readiness for business continuity
5.3118.1.1, 18.1.5Legal, statutory, regulatory and contractual requirements
5.3218.1.2Intellectual property rights
5.3318.1.3Protection of records
5.3418.1.4Privacy and protection of PII
5.3518.2.1Independent review of information security
5.3618.2.2, 18.2.3Compliance with policies, rules and standards for information security
5.3712.1.1Documented operating procedures

People Controls

ISO/IEC 27002:2022 Control IdentifierISO/IEC 27002:2013 Control IdentifierControl Name
6.107.1.1Screening
6.207.1.2Terms and conditions of employment
6.307.2.2Information security awareness, education and training
6.407.2.3Disciplinary process
6.507.3.1Responsibilities after termination or change of employment
6.613.2.4Confidentiality or non-disclosure agreements
6.706.2.2Remote working
6.816.1.2, 16.1.3Information security event reporting

Physical Controls

ISO/IEC 27002:2022 Control IdentifierISO/IEC 27002:2013 Control IdentifierControl Name
7.111.1.1Physical security perimeters
7.211.1.2, 11.1.6Physical entry
7.311.1.3Securing offices, rooms and facilities
7.4NewPhysical security monitoring
7.511.1.4Protecting against physical and environmental threats
7.611.1.5Working in secure areas
7.711.2.9Clear desk and clear screen
7.811.2.1Equipment siting and protection
7.911.2.6Security of assets off-premises
7.1008.3.1, 08.3.2, 08.3.3, 11.2.5Storage media
7.1111.2.2Supporting utilities
7.1211.2.3Cabling security
7.1311.2.4Equipment maintenance
7.1411.2.7Secure disposal or re-use of equipment

Technological Controls

ISO/IEC 27002:2022 Control IdentifierISO/IEC 27002:2013 Control IdentifierControl Name
8.106.2.1, 11.2.8User endpoint devices
8.209.2.3Privileged access rights
8.309.4.1Information access restriction
8.409.4.5Access to source code
8.509.4.2Secure authentication
8.612.1.3Capacity management
8.712.2.1Protection against malware
8.812.6.1, 18.2.3Management of technical vulnerabilities
8.9NewConfiguration management
8.10NewInformation deletion
8.11NewData masking
8.12NewData leakage prevention
8.1312.3.1Information backup
8.1417.2.1Redundancy of information processing facilities
8.1512.4.1, 12.4.2, 12.4.3Logging
8.16NewMonitoring activities
8.1712.4.4Clock synchronization
8.1809.4.4Use of privileged utility programs
8.1912.5.1, 12.6.2Installation of software on operational systems
8.2013.1.1Networks security
8.2113.1.2Security of network services
8.2213.1.3Segregation of networks
8.23NewWeb filtering
8.2410.1.1, 10.1.2Use of cryptography
8.2514.2.1Secure development life cycle
8.2614.1.2, 14.1.3Application security requirements
8.2714.2.5Secure system architecture and engineering principles
8.28NewSecure coding
8.2914.2.8, 14.2.9Security testing in development and acceptance
8.3014.2.7Outsourced development
8.3112.1.4, 14.2.6Separation of development, test and production environments
8.3212.1.2, 14.2.2, 14.2.3, 14.2.4Change management
8.3314.3.1Test information
8.3412.7.1Protection of information systems during audit testing
Updated for ISO 27001 2022
  • 81% of the work done for you
  • Assured Results Method for certification success
  • Save time, money and hassle
Book your demo
img

Explore ISMS.online's platform with a self-guided tour - Start Now