A.5.14
Information transfer
Organizational controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control requires that confidentiality, integrity, and availability be maintained whenever information is exchanged between internal units and with external parties. Its scope covers electronic transfer (email, file transfer, messaging, system interfaces), physical media transfer (movement of documents and storage media), and verbal transfer (in person, by phone, in meetings). The aim is to establish policies and procedures for each transfer method so that information is not intercepted, altered, lost, or misdelivered in transit, and to put agreements in place for transfers with external parties that define the responsibilities and protection levels of each side. The level of protection should be applied in proportion to the classification of the information.
Key checkpoints
- Are protection policies and procedures established for each transfer method (electronic/physical/verbal), with protection levels differentiated by information classification?
- Are transfer agreements (contracts/arrangements) concluded with external parties that define responsibilities, protective measures, incident notification/handling, and return/disposal?
- Are technical safeguards such as transport encryption, integrity checking, and recipient authentication applied to electronic transfers?
- When physical media are transported, are controls such as trusted couriers, packaging/sealing, and handover records applied?
- Are measures in place to prevent misdelivery, wrong attachments, and unauthorized auto-forwarding in email/messaging?
- Are employees and external parties aware of and compliant with transfer rules and precautions, including preventing verbal disclosure in public places?
Implementation guidance
- Define, in line with the classification scheme, which channels are permitted and what protection each requires, and document this as policies and procedures covering electronic, physical, and verbal transfer.
- Apply encryption and peer authentication appropriate to the transfer protocol, such as TLS for web/API traffic and SSH for SFTP. Add end-to-end or document-level encryption according to sensitivity and intermediary exposure.
- Where there is regular or bulk transfer with external organizations, include in the data transfer agreement the security requirements, allocation of responsibility, incident notification procedure, data return/disposal conditions, and restrictions on subcontracting.
- Protect documents and removable media through approved transport, locked storage, sealing, and handover records. Apply appropriate encryption to electronic media and physical safeguards such as secure packaging and recipient verification to paper documents.
- Prevent misdelivery with recipient checks, external-send warnings, send delays, sensitive-transfer approval, and DLP rules. Message recall can fail depending on the recipient environment and must not replace incident handling after disclosure.
- Include in training the awareness criteria for verbal transfer, such as limiting conversations in public places, guarding against eavesdropping in meeting rooms, and caution with speakerphone/video conferencing.
- Keep transfer records (sender, recipient, time, information transferred) and periodically review for abnormal sending to act on anomalies.
Evidence
- Information transfer policy/procedure (covering electronic, physical, and verbal transfer) and transfer guidance per classification
- Data transfer agreements/contracts with external parties (including security requirement clauses)
- Encryption configuration records for electronic transfer (TLS, mail encryption, SFTP setup)
- Handover logs for physical media transport, and sealing/packaging and media-encryption records
- Email security settings (external-send warning, DLP rules, auto-forward restriction) and approval history for large/sensitive sends
- Transfer-related training materials and completion records for employees and external parties, plus transfer logs/review results
Nonconformity examples
- A transfer policy exists but lacks procedures for physical media transport or verbal transfer, being limited to electronic transfer only.
- Sensitive or personal information is sent to external parties by email in plaintext without encryption.
- Information is regularly transferred to external organizations without concluding a transfer agreement that sets out security requirements and responsibilities.
- Links are shared through a large-file transfer service without expiry or access controls, allowing an unspecified number of people to download.
- Email auto-forwarding rules continuously send internal information to personal external accounts without control or monitoring.
- Data is taken out on removable storage media without handover records or media encryption.