A.5.10
Acceptable use of information and other associated assets
Organizational controlsCheckpoints 5Evidence 5Cases 5
Control objective
This control requires the organization to define rules for how employees and external users may and may not use information and information processing assets, and to have those rules observed. It calls for handling, storage, transfer, and disposal methods that match the classification level of the asset, so that the risk of leakage or damage from misuse, unauthorized removal, or inappropriate sharing is reduced. The intent is to document the rules and communicate them to everyone who uses the assets, so that each person uses the assets while clearly aware of their own responsibilities.
Key checkpoints
- Are rules (policy/guideline) for acceptable use of information and associated assets established and linked to asset classification levels?
- Are the rules communicated to everyone who uses the assets, including employees and external users, with a procedure for users to acknowledge or accept them?
- Are permitted and prohibited actions specified concretely for each lifecycle stage, such as handling, storage, transfer, movement, and disposal?
- Are acceptable use criteria defined for remote work, personally owned devices (BYOD), removable media, and use of cloud/external services?
- Are actions and responsibilities defined for rule violations, and is compliance with the rules checked?
Implementation guidance
- Link the rules to the information classification scheme (for example, confidential/internal/public) and specify the handling and use permitted for each classification level.
- Clearly define what is permitted and prohibited for screen/document exposure, removal and external transfer, printing/copying, use of removable media, and use of external services such as personal cloud or messengers.
- Include in the rules the minimum security requirements for remote work and personally owned devices (BYOD), such as encryption, screen lock, and loss reporting.
- Communicate the rules at onboarding/contract time and through periodic training, and secure acknowledgement/acceptance in the form of a security pledge or use agreement.
- Define in advance the procedure for handling violations (warning, revocation of access rights, linkage to disciplinary action) and where responsibility lies.
- Review the asset use rules periodically and keep them current, reflecting organizational change, adoption of new technology, and incident lessons.
Evidence
- Rules for acceptable use of information and other associated assets (policy/guideline/handling procedure)
- Documented handling/storage/transfer/disposal criteria by information classification level
- Security pledges or asset use agreement records
- Approval and management records for remote work/BYOD/removable media use
- Records of rule communication/training and of actions taken for violations
Nonconformity examples
- Rules for acceptable use of assets do not exist in documented form, or they exist but are not linked to asset classification levels.
- The rules apply only to employees and are not communicated to or applied to external users such as outsourced or dispatched staff.
- There are no criteria permitting or prohibiting removal of business information via removable media or personal cloud/messengers, so it goes uncontrolled.
- Assets are granted without any security pledge or use agreement, so users are not aware of the scope of their responsibilities.
- Even when a violation is confirmed, no handling procedure or responsibility is defined, so no meaningful follow-up action is taken.