ISO 27001 A.5.14 - Information Transfer

Requirement

“Information transfer rules, procedures, or agreements shall be in place for all types of transfer facilities within the organization and between the organization and other parties.”

Plain-language meaning

The organization must define how information can be transferred safely, both internally and externally.

This includes email, file sharing, messaging apps, collaboration platforms, cloud storage, removable media, phone calls, video calls, fax, post, courier, printers, and any other method used to move information from one person, system, organization, or location to another.

Why this matters

Information transfer is where many leaks happen. People send information to the wrong recipient, use the wrong channel, forget encryption, leave printouts unattended, discuss confidential topics in public, or rely on third-party platforms without checking the controls.

Transfer rules should make the expected behavior clear before sensitive information moves.

Implementation guidance

1. Identify transfer channels

Start by listing the transfer methods actually used by the organization.

Examples:

Do not write policy for imaginary channels while ignoring the tools staff actually use.

2. Define rules by information sensitivity

Transfer rules should align with A.5.12 Classification of Information, A.5.13 Labelling of Information, and A.5.10 Acceptable Use of Information and Other Associated Assets.

Example:

The point is not to ban transfer. The point is to transfer using controls that match the risk.

3. Control electronic messaging and collaboration

Email and messaging need specific rules because they are easy to misuse.

Rules should cover:

• permitted services by data type;
• external recipient checks;
• attachment encryption;
• link sharing settings;
• malware scanning;
• source and integrity checks for incoming files;
• retention and backup implications;
• contracts or commitments implied by messages;
• use of disclaimers without pretending they solve the risk;
• restrictions on consumer messaging apps.

If external messaging platforms are permitted, define who can use them, for what purpose, with what information, and how use is monitored.

4. Control physical and verbal transfer

Transfer is not only digital.

Rules should cover:

• secure printing and prompt collection;
• no unattended sensitive printouts;
• sealed envelopes or tamper-evident packaging;
• courier identity checks;
• secure storage before dispatch;
• confirmation of receipt;
• avoiding sensitive calls in public places;
• voicemail and answering machine restrictions;
• secure handling of fax where still used.

Old channels are not harmless just because they are old.

5. Use agreements for third-party transfer

Where sensitive information is exchanged with third parties, agreements should define the required controls.

Agreements should cover:

• information types and classification;
• permitted transfer methods;
• encryption or secure portal requirements;
• recipient authorization;
• malware scanning;
• retention and deletion;
• onward transfer restrictions;
• incident notification;
• audit or assurance rights;
• review frequency;
• change control for transfer methods.

Agreements should be authorized at the right level and reviewed periodically. If actual practice changes, the agreement must be updated.

6. Train people with real examples

Training should include practical failure scenarios:

• selecting the wrong email autocomplete recipient;
• sending attachments instead of controlled links;
• sharing public cloud links;
• discussing confidential matters on trains or in cafes;
• leaving documents in printers;
• sending files through unapproved chat apps;
• trusting a third party’s weaker transfer controls without approval.

Audit guidance

Auditors should verify that information transfer rules, procedures, or agreements exist and cover the transfer channels the organization actually uses.

Audit testing should include:

• policy and procedure review;
• interviews with users;
• samples of sensitive external transfers;
• review of third-party agreements;
• review of approved messaging platforms;
• technical checks for blocked or allowed transfer channels;
• review of email, DLP, file-sharing, or secure transfer controls;
• incident records involving misdirected or mishandled transfer.

The auditor should challenge a policy that says “use secure transfer” without defining which channels are approved for which data.

Evidence examples

Strong evidence

• Transfer rules cover digital, physical, verbal, and third-party transfers.
• Approved transfer methods are mapped to information classifications.
• Sensitive transfers use encryption, recipient verification, access control, logging, or secure portals.
• Third-party agreements define transfer controls and are periodically reviewed.
• Users can explain which channels are allowed for sensitive data.
• Technical controls block or detect prohibited transfer methods.
• Incidents involving transfer errors lead to corrective actions.

Weak evidence

• Generic “send securely” wording with no channel-specific guidance.
• Email is used for all classifications with no extra controls.
• Staff use unapproved messaging or cloud platforms.
• Third-party transfers happen without agreements.
• No monitoring for external sharing.
• No user awareness of wrong-recipient or public-place risks.
• Disclaimers are treated as the main protection.

Common failures

Exam traps

• Information transfer is not only email.
• Transfer rules must cover internal and external transfers.
• Agreements matter when sensitive information is exchanged with third parties.
• Disclaimers do not replace transfer controls.
• Classification should drive transfer method and protection.
• Physical and verbal transfer risks still count.
• Approved external messaging platforms still need access control, monitoring, and use-case limits.

Related controls and concepts

• A.5.10 Acceptable Use of Information and Other Associated Assets
• A.5.12 Classification of Information
• A.5.13 Labelling of Information
• Information Classification and Handling Matrix
• A.5.9 Inventory of Information and Other Associated Assets
• Risk Assessment
• Statement of Applicability
• Internal Audit

KB-ready summary

A.5.14 requires rules, procedures, or agreements for information transfer across all relevant transfer facilities. The practical goal is to define approved channels, match transfer controls to classification, protect electronic and physical transfer, govern third-party exchanges, train users, and monitor or enforce the rules.

Templates and checklists

• Information Transfer Rules Matrix
• Third-Party Information Transfer Agreement Checklist
• A.5.14 Audit Checklist
• Information Classification and Handling Matrix