Key takeaways
- Protect information when you send it by any means: email, file share, paper or verbal.
- Information is most exposed when it moves: email, file sharing, removable media or verbal conversations.
- Start here: list how information moves in and out of the organisation.
Purpose
Protect information when you send it by any means: email, file share, paper or verbal.
Requirement
Requirement summaryInformation transfer rules, procedures, or agreements shall be in place for all types of transfer facilities within the organization and between the organization and other parties.
Why it matters
Information is most exposed when it moves: email, file sharing, removable media or verbal conversations.
How to implement
- List how information moves in and out of the organisation.
- Set rules for each transfer method, aligned to classification.
- Use secure channels such as encrypted email or managed file sharing for sensitive data.
- Put transfer agreements in place with external parties where needed.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.14. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your information transfer policy: approved ways to share information by email, file sharing, post and phone.
- Agreements with partners you regularly exchange data with, including security terms.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.14 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A few recent examples of confidential data sent outside the company using an approved, protected method.
- Courier or tracked delivery records for physical media, if used.
Things you should be able to show or explain
- Be able to show how you send a confidential file to a customer or supplier.
How much to show: A handful of recent external transfers.
Common mistakes
- Confidential data sent by unprotected email.
- No agreement for regular data exchanges.
- Ignoring informal channels like chat apps and personal email.
- No agreement covering regular bulk transfers to partners.
- Tip: Define approved transfer tools and ban the rest.
Policies & documents to have
- Third-Party Management Policy
FAQ
Is A.5.14 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.14?
Be ready to explain how the control works in your organisation and to provide things like: Your information transfer policy: approved ways to share information by email, file sharing, post and phone…