A.5.32
Intellectual property rights
Organizational controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control ensures that the organization uses intellectual property (copyright, software licenses, patents, trademarks, trade secrets, source code, design documents, datasets, and similar) lawfully, and that it also protects its own intellectual property. The aim is to prevent legal disputes, damages, fines, and reputational harm arising from unauthorized copying, exceeding or breaching license terms, or installing illegal software. To achieve this, the organization must know the licenses and ownership of the software and materials it uses, and put procedures and controls in place so that contractual terms and applicable laws are met across acquisition, use, distribution, and disposal.
Key checkpoints
- Are procedures and responsibilities defined for identifying and managing assets subject to intellectual property rights (software, copyrighted works, data) and their license terms?
- Is actual software installation/use periodically reconciled against the applicable license metrics and terms for users, devices, cores, subscriptions, or other entitlements?
- Are preventive controls in place (restricting install privileges, awareness) to stop employees and external parties from installing unauthorized/illegal software or copying works without permission?
- Are proof of license (purchase/contract/certificate) and proof of ownership retained, and are license expiry, renewal, and reclamation managed?
- Are the usage terms of open source, third-party materials, and materials obtained from public networks reviewed and complied with?
- Are the ownership and right to use the organization's own intellectual property (source code, design documents, brand) protected through contracts and policy?
Implementation guidance
- Establish an intellectual property rights management policy that states the scope (commercial software, open source, copyrighted works such as fonts/images/documents, datasets, patents/trademarks, in-house deliverables) and the compliance principles.
- Record entitlements, installations, and actual use in the software asset register. Reconcile use against the license metric and conditions, such as users, devices, cores, concurrent use, or subscription rights.
- Control software installation privileges on workstations/servers, and use asset scanning/inventory tools to detect and remove unauthorized or illegal software.
- Review the applicable open source license and version, and obligations arising from modification, distribution, or service delivery. Check relevant notices, attribution, and source-provision conditions without assuming identical obligations for all open source. Use an SBOM and review process where needed to verify deliverables.
- Securely retain license agreements, purchase records, certificates, and proof of ownership, and track expiry/renewal/reassignment (including reclaiming licenses on termination and role change).
- Communicate the prohibition of unauthorized copying and illegal installation, and the consequences of violation, through awareness training, security undertakings, and contract clauses, and secure ownership of the organization's own intellectual property and confidentiality obligations by contract.
Evidence
- Intellectual property rights and software license management policy/procedures
- Software asset register (licenses held, installation status, usage) and periodic reconciliation/audit results
- License agreements, purchase records, certificates, and expiry/renewal management records
- Results of unauthorized/illegal software detection (asset scanning/inventory) and remediation records
- Open source usage review sheets, SBOM, and evidence of meeting license obligations (attribution notices, and so on)
- IPR awareness training materials/undertakings, and intellectual property ownership and confidentiality clauses in contracts
Nonconformity examples
- Records cannot establish license entitlements and use, or use exceeds the applicable contractual limits for users, devices, cores, or other metrics.
- There is no control over install privileges on workstations, so employees can freely install illegal or unauthorized software.
- Software continues to be used after license expiry without renewal, or licenses assigned to leavers are not reclaimed or reassigned.
- Open source is adopted/distributed without reviewing its license terms (attribution, source disclosure, and so on), breaching the obligations.
- Fonts/images/documents obtained from public networks are used commercially without checking the usage terms.
- Ownership of outsourced development deliverables and source code is not stated in the contract, leaving the intellectual property rights unclear.