Control 5.32 outlines the steps that organisations need to take to ensure that they remain compliant with intellectual property (IP) rights, including the use of proprietary software that is purchased, subscribed to or otherwise leased.
ISO defines intellectual property rights as belonging to one or more of the following categories:
“Legal, statutory, regulatory or contractual” agreements often place restrictions on how proprietary software is able to be used, including blanket restrictions on the copying, extraction or reverse-engineering of source code, among other measures.
For clarity, Control 5.32 does not deal with situations where the organisation is the IP holder, and instead focuses on their obligation towards third party intellectual property rights that are stated within a licence agreement, a data sharing agreement, or any other comparable legal mechanism.
It’s important to note that copyright and/or IP infringement often carries severe financial and legal consequences for any organisation that wilfully or unwittingly breaks the terms of an agreement. As such, Control 5.32 should be given adequate consideration, in order to avoid any unnecessary business disruption or information security events.
Control 5.32 is a preventive control that maintains risk by implementing procedures to ensure that the organisation remains compliant with any prevailing IP or copyright requirements, including mitigating the risk of the organisation’s own personnel failing to uphold their individual obligations.
Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
---|---|---|---|---|
#Preventive | #Confidentiality #Integrity #Availability | #Identify | #Legal and Compliance | #Governance and Ecosystem |
If you don’t use ISMS.online, you’re making your life more difficult than it needs to be!
Control 5.32 asks organisations to consider the following guidelines, in order to safeguard any data, software or assets that could be deemed IP:
27002:2022-5.32 replaces 27002:2013-18.1.2 (Intellectual property rights).
27002:2022-5.31 contains broadly the same set of guidelines as its 2013 counterpart, with two minor additions:
ISMS.online streamlines the ISO 27002 implementation process by providing a sophisticated cloud-based framework for documenting information security management system procedures and checklists to assure compliance with recognised standards.
Get in touch today to book a demo.
We’ll give you an 81% headstart
from the moment you log in
Book your demo
ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
---|---|---|
5.7 | New | Threat intelligence |
5.23 | New | Information security for use of cloud services |
5.30 | New | ICT readiness for business continuity |
7.4 | New | Physical security monitoring |
8.9 | New | Configuration management |
8.10 | New | Information deletion |
8.11 | New | Data masking |
8.12 | New | Data leakage prevention |
8.16 | New | Monitoring activities |
8.23 | New | Web filtering |
8.28 | New | Secure coding |
ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
---|---|---|
6.1 | 07.1.1 | Screening |
6.2 | 07.1.2 | Terms and conditions of employment |
6.3 | 07.2.2 | Information security awareness, education and training |
6.4 | 07.2.3 | Disciplinary process |
6.5 | 07.3.1 | Responsibilities after termination or change of employment |
6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
6.7 | 06.2.2 | Remote working |
6.8 | 16.1.2, 16.1.3 | Information security event reporting |
ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
---|---|---|
7.1 | 11.1.1 | Physical security perimeters |
7.2 | 11.1.2, 11.1.6 | Physical entry |
7.3 | 11.1.3 | Securing offices, rooms and facilities |
7.4 | New | Physical security monitoring |
7.5 | 11.1.4 | Protecting against physical and environmental threats |
7.6 | 11.1.5 | Working in secure areas |
7.7 | 11.2.9 | Clear desk and clear screen |
7.8 | 11.2.1 | Equipment siting and protection |
7.9 | 11.2.6 | Security of assets off-premises |
7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
7.11 | 11.2.2 | Supporting utilities |
7.12 | 11.2.3 | Cabling security |
7.13 | 11.2.4 | Equipment maintenance |
7.14 | 11.2.7 | Secure disposal or re-use of equipment |