Acceptable use of information and other associated assets

Plain-language summary

Writing down and putting into practice what people may and may not do with the organisation's information and assets, and how each type of information must be handled, so expected behaviour is clear to employees, contractors and other users.

What the clause is really asking

This control asks for two things written down and put into practice: rules on acceptable use, and procedures for handling information and related assets. They are often confused. The acceptable use policy tells users what is expected and what is not: personal use of equipment, internet and email use, installing software, personal devices, removable media, copying information, and the monitoring the organisation carries out. The handling procedures tell them how to treat information at each classification level throughout its life — storing, sharing, printing, sending, keeping and destroying it. Both must reach everyone with access, including contractors and suppliers. The common misunderstanding is that an acceptable use policy signed at induction is the whole control. It has to stay current: most policies now need a section on public generative AI tools, which is where confidential and personal information leaks today. In South Africa, if you monitor email, internet use or devices, say so plainly and obtain consent through the employment contract — RICA and POPIA both bear on workplace monitoring.

What auditors look for

Auditors ask for the acceptable use policy and the handling procedures, then check they are linked to the classification scheme. They interview staff and a contractor: what may you use your work laptop for, may you paste client data into an AI chatbot, how should you send a confidential file? They look for signed or electronic acknowledgements. They test enforcement — software installed against policy, data on unmanaged USB devices, monitoring applied as described. They check that monitoring is disclosed to staff. The hard question: what happened the last time someone broke the acceptable use policy?

Typical evidence

Acceptable use policy covering devices, email, internet, software, personal devices, removable media, monitoring and AI tools; handling procedures per classification level; signed or electronic acknowledgements from employees and contractors; employment contract clauses on monitoring and consent; technical enforcement settings such as application control or web filtering; records of breaches and actions taken.

How to comply — recommendations

Write a short acceptable use policy in plain language — three or four pages — covering devices, email, internet, software installation, personal devices, removable media, cloud and AI tools, monitoring and the consequences of breach. Add a one-page handling table: for each classification level, how to store, share, print, send, keep and destroy information. Have everyone acknowledge the policy at induction and again after each significant change. Make sure employment contracts disclose monitoring. Back the rules with technical controls where practical — blocking unapproved software, restricting USB storage, approved AI tools only. Review annually, and record breaches and how they were handled.

Common nonconformities

No acceptable use policy, or one that ignores cloud, personal devices or AI tools; handling procedures missing or not linked to classification; contractors never shown the policy; no acknowledgement records; monitoring carried out but not disclosed; rules contradicted by practice, such as unrestricted software installation; breaches not recorded or handled inconsistently.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.