ISO 27001 A.5.32 - Intellectual Property Rights

Requirement

“The organization shall implement appropriate procedures to protect intellectual property rights.”

Plain-language meaning

The organization must have procedures that prevent unauthorized use, copying, distribution, modification, or licensing misuse of software, documents, designs, source code, trademarks, patents, subscription content, and AI-generated or AI-assisted material.

Why this matters

IP failures create legal, financial, contractual, and reputational risk. Common failures include over-installed software, unapproved libraries, copied training/course material, unclear source-code rights, misuse of third-party content, and AI-generated output with unclear ownership or licence terms.

Implementation guidance

1. Define rules for handling copyrighted material, software, documents, designs, trademarks, patents, source code, open-source components, subscription content, and AI-generated content.
2. Maintain software and licensed-content inventories that show licence owner, permitted use, user/device count, restrictions, renewal, and evidence.
3. Perform periodic licence compliance checks for workstations, servers, development tools, cloud tools, and subscription services.
4. Review development and support contracts for source-code access, modification rights, use/location restrictions, escrow, transfer rights, and third-party component obligations.
5. Review open-source and third-party library licences before use in products, client work, templates, or internal systems.
6. Define AI-generated content rules covering provider terms, input data rights, output ownership, copyright risk, attribution, confidentiality, and approval before external use.
7. Train personnel that unauthorized copying or use of IP-protected material can create civil, contractual, and criminal exposure depending on jurisdiction.

Audit guidance

Auditors should verify that IP protection procedures exist, users understand them, licensed software and copyrighted resources are tracked, licence terms are understood, random endpoint/server samples match licence records, and development/library/AI content practices are controlled.

Evidence examples

Strong evidence

• IP handling procedures cover software, documents, source code, libraries, trademarks, designs, patents, subscription content, and AI-generated material.
• Software and content inventories map licences to actual use, devices, users, restrictions, renewal dates, and evidence.
• Periodic licence checks sample workstations, servers, cloud tools, and development environments.
• Development contracts and support agreements define source-code and modification rights.
• Open-source and third-party libraries are reviewed for licence obligations before use.
• AI-generated content is reviewed for ownership, input rights, provider terms, confidentiality, and external-use approval.

Weak evidence

• Policy says respect copyright but has no operating procedure.
• Software inventory exists but licence terms and actual installations are not reconciled.
• Developers can add libraries without licence review.
• AI-generated content is used externally without checking provider terms or source rights.
• Subscription content is shared outside licence terms.
• Staff are unaware that unauthorized copying can trigger legal action.

Common failures

Exam traps

• A.5.32 is not only about software piracy; it covers copyright, design rights, trademarks, patents, source code, licences, subscription content, and AI-generated material.
• A software inventory alone is weak unless it is reconciled against licence rights and actual use.
• Users need awareness of IP handling rules.
• Development tools and libraries must be checked for licence restrictions.
• AI output can create IP and ownership questions; provider terms and source material matter.

Related controls and concepts

• Information and Associated Asset Inventory
• Acceptable Use and Information Handling Rules
• Supplier Security Agreement Requirements Checklist
• Policy Register
• Internal Audit
• Risk Assessment

KB-ready summary

A.5.32 requires practical compliance governance: obligations must be identified, owned, documented, kept current, mapped to controls, and evidenced. In audit, the useful proof is not a policy statement; it is a maintained register, mapped controls, responsible owners, and sampled records showing the process operates.

Templates and checklists

• Intellectual Property Rights Register
• Software and Content Licence Compliance Inventory
• AI-Generated Content IP Review Checklist
• A.5.32 Audit Checklist