Information Transfer - ISO 27001 Annex A Control
ISO 27001 Annex A 5.14
Information leaving the organisation needs the protection that goes with it.
ISO 27001 Annex A 5.14 - Information Transfer
Information transfer is the moment information moves between systems, networks, locations or organisations. Each transfer is a moment where information can be intercepted, lost or sent to the wrong place. The control is about having defined rules so that transfers happen through approved channels with appropriate protection.
Internal transfers cover information moving between systems within the organisation - between cloud services, between offices, between departments. Even within the organisation the rules need to be clear: which channels are approved for which classification, what kind of authentication is required, and what audit trail is kept.
External transfers add the layer of protecting information once it leaves the organisation's direct control. That typically means encryption in transit and at rest, secure file transfer rather than email for higher-classification material, and a documented agreement with the recipient setting out their handling responsibilities.
For us the rule is simple. Anything Confidential goes through the secure file transfer service, not email. Anything with personal data goes the same way unless the recipient has set up the proper exchange route. Email attachments are fine for general business material but not for anything sensitive. Staff get this through induction and refresher training.
Practical Compliance Guidance
Information transfer arrangements are described in the IMS1 manual at section 8.5 alongside the topic-specific Information Transfer Policy and the Communications Policy.
| alphaZ document | How to use it |
|---|---|
| ISO 27001 Toolkit | The full alphaZ ISO 27001 toolkit covering manual, policies, procedures, registers and audit checklists. |
| PP-8-100 Information Security Policy Procedure | Contains the Information Transfer Policy and Communications Policy, which set out the rules for internal and external transfers and the approved channels for each classification. |
Note - all the above files can be downloaded with an alphaZ subscription.
