Key takeaways
- Respect intellectual property, including software licences.
- Using software, content and code without the right licence creates legal and financial risk.
- Start here: keep records of software licences and terms.
Purpose
Respect intellectual property, including software licences.
Requirement
Requirement summaryThe organization shall implement appropriate procedures to protect intellectual property rights.
Why it matters
Using software, content and code without the right licence creates legal and financial risk.
How to implement
- Keep records of software licences and terms.
- Control installation so only approved software is used.
- Check open-source licence obligations in your products.
- Respect copyright on content and documentation.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.32. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules on software licences and using other people's content.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.32 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Software licence records matching what is installed.
- Approval records for installing new software.
Things you should be able to show or explain
- Be able to show that only approved software is on devices.
How much to show: Two or three key software products.
Common mistakes
- Unlicensed software.
- Anyone can install anything.
- Unlicensed software found on staff machines.
- Ignoring open-source licence conditions.
- Tip: Track licences in your asset inventory.
Policies & documents to have
- Legal, regulatory and contractual requirements register
- Information Security Policy
FAQ
Is A.5.32 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.32?
Be ready to explain how the control works in your organisation and to provide things like: Your rules on software licences and using other people's content…