ISO 27001 A.5.10 - Acceptable Use of Information and Other Associated Assets

Requirement

“Rules for the acceptable use and procedures for handling information and other associated assets shall be identified, documented and implemented.”

Plain-language meaning

People must know how they are allowed to use organizational information and assets, and how they must handle information based on sensitivity and classification.

This is not just an IT acceptable use policy. It covers information and associated assets in any form: systems, devices, networks, software, printers, copiers, paper records, removable media, cloud services, and sensitive information shared with third parties.

Why this matters

Assets are often misused because rules are vague, unread, or not enforced. Misuse can be accidental or deliberate, but the result can still be data leakage, system compromise, service disruption, legal exposure, or harm to other organizations.

Examples:

• browsing risky websites from corporate devices;
• using company systems for unauthorized activity;
• sending confidential files to personal email;
• printing sensitive records and leaving them unattended;
• copying data to unmanaged USB drives;
• sharing credentials;
• using cloud tools not approved for sensitive data;
• letting couriers or unknown parties collect sensitive material without checks.

Implementation guidance

1. Define acceptable use rules

Rules should explain what use is allowed, restricted, and prohibited.

Typical areas:

Rules should be readable. A 40-page policy nobody understands is weak control design.

2. Link handling rules to classification

Handling procedures should match the sensitivity of the information.

If the organization uses different labels, use those labels. The point is that users need practical instructions for processing, storing, transmitting, printing, releasing, and disposing of information.

3. Get acknowledgement before access

Users should acknowledge acceptable use rules before receiving access to relevant assets.

This should apply to:

• employees;
• contractors;
• temporary workers;
• third-party users;
• administrators;
• privileged support providers;
• anyone else using organizational assets.

Acknowledgement is not magic. It is useful evidence only if the rules are clear, communicated, and enforced.

4. Detect and respond to misuse

Controls should support detection and response.

Examples:

• security monitoring;
• web filtering;
• DLP alerts;
• logon warning banners;
• print monitoring for sensitive areas;
• incident reporting;
• disciplinary procedures;
• corrective action tracking;
• awareness refreshers after incidents.

Misuse handling should distinguish deliberate abuse from inadvertent non-compliance, but both need response.

5. Cover external parties and sensitive handling

External parties should follow equivalent handling rules where they access or receive organizational information.

Check:

• contracts;
• confidentiality agreements;
• non-disclosure agreements;
• data processing agreements;
• supplier security requirements;
• classification interpretation for external parties;
• return or disposal requirements.

Audit guidance

Auditors should verify that acceptable use rules and handling procedures are defined, documented, implemented, communicated, acknowledged, and enforced.

Audit testing should include:

• policy and procedure review;
• user acknowledgement records;
• interviews to test awareness;
• incident records involving misuse;
• monitoring and detection controls;
• disciplinary or corrective action records;
• observation of sensitive information handling;
• external-party agreements;
• classification-specific handling procedures.

The audit should not stop at “policy exists.” The real test is whether users understand and follow the rules.

Evidence examples

Strong evidence

• Acceptable use rules are clear, current, readable, and mapped to asset types.
• Classification labels have practical handling procedures.
• Users acknowledge rules before access is granted.
• Contractors and third-party users are covered.
• Misuse is monitored, investigated, and corrected.
• Incident reports lead to rule or awareness improvements.
• Sensitive information handling is observable in daily work.
• External agreements support internal handling expectations.

Weak evidence

• Generic policy copied from the internet.
• Users acknowledge rules after access is already granted.
• No classification-based handling instructions.
• Rules cover laptops but ignore printers, paper, removable media, or cloud services.
• Contractors and third parties are not covered.
• No monitoring or response for misuse.
• Staff cannot explain what is inappropriate use.
• Sensitive documents are left unattended or shared broadly.

Common failures

Exam traps

• Acceptable use is broader than internet browsing.
• Procedures must cover handling of information, not only use of devices.
• Rules should apply to contractors and third-party users where they use organizational assets.
• Classification labels are not enough; handling rules must explain what to do.
• User acknowledgement is useful evidence, but it does not prove implementation by itself.
• Misuse can be unintentional or deliberate; both matter.

Related controls and concepts

• A.5.1 Policies for Information Security
• A.5.2 Information Security Roles and Responsibilities
• A.5.4 Management Responsibilities
• A.5.9 Inventory of Information and Other Associated Assets
• Information and Associated Asset Inventory
• Internal Audit
• Risk Assessment
• Statement of Applicability

KB-ready summary

A.5.10 requires documented and implemented rules for acceptable use and handling of information and associated assets. The rules should define permitted and prohibited use, classification-based handling, acknowledgement before access, detection of misuse, response to violations, and coverage for contractors and third parties.

Templates and checklists

• Acceptable Use and Information Handling Rules
• A.5.10 Audit Checklist
• Policy Communication and Acknowledgement Tracker
• Evidence Request List