Key takeaways
- Set rules for how people may use company information and equipment.
- Rules for using information and assets prevent careless handling, leakage and misuse by well-meaning staff.
- Start here: write an acceptable use policy covering devices, email, internet, cloud tools and data handling.
Purpose
Set rules for how people may use company information and equipment.
Requirement
Requirement summaryRules for the acceptable use and procedures for handling information and other associated assets shall be identified, documented and implemented.
Why it matters
Rules for using information and assets prevent careless handling, leakage and misuse by well-meaning staff.
How to implement
- Write an acceptable use policy covering devices, email, internet, cloud tools and data handling.
- Link handling rules to your classification levels.
- Get staff to acknowledge the rules at onboarding.
- Monitor for misuse in a way that respects privacy law.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.10. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your acceptable use policy: the rules for using company information and equipment.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.10 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Proof that staff and contractors have accepted the rules.
- Records of any misuse cases and how they were dealt with.
- A list of managed devices or accounts showing equipment is used as the rules say.
Things you should be able to show or explain
- Staff should be able to name a few key rules, such as not sharing passwords.
How much to show: A handful of users, including contractors.
Common mistakes
- Contractors not covered by the rules.
- Rules updated but not re-shared with staff.
- Rules too vague to act on, such as 'use systems responsibly'.
- No mention of personal devices or generative AI tools.
- Tip: Get staff to acknowledge the acceptable use policy at onboarding.
Policies & documents to have
- Asset Management Policy
- Data Management Policy
- Information Security Policy
FAQ
Is A.5.10 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.10?
Be ready to explain how the control works in your organisation and to provide things like: Your acceptable use policy: the rules for using company information and equipment…