Information transfer

Plain-language summary

Setting rules, procedures or agreements for moving information — inside the organisation and to and from other parties — by every route it travels: email, file-sharing, messaging apps, portals, removable media, courier and conversation.

What the clause is really asking

Information is most exposed when it moves. This control asks you to have rules, procedures or agreements in place for every way information moves, both inside the organisation and to and from outsiders. Electronic transfer covers email, file-sharing links, messaging apps, portals and APIs; physical transfer covers removable media, couriers and paper; verbal transfer covers phone calls, video meetings and conversations in public places. The rules should follow classification: what may go by which channel, when encryption is required, how recipients are verified, and what records are kept. With external parties, contracts, data-sharing agreements or NDAs should set the security requirements for the exchange. The common misunderstanding is that email encryption covers it, while sales sends price lists over WhatsApp and finance accepts changed bank details by email. Business email compromise and payment redirection fraud are a persistent problem for South African businesses, so verifying changes to banking details belongs here. Personal information passed to operators needs section 21 terms under POPIA, and transfers abroad need a section 72 basis.

What auditors look for

Auditors ask for the transfer rules and agreements, then test how information actually leaves the building. They ask staff how they would send a confidential file to a client, check the file-sharing tool for links open to anyone with the link, and look at whether removable media is restricted. They pick an external party that regularly receives personal or confidential information and ask for the agreement covering it. They ask finance how a supplier's change of bank details is verified. The hard question: which channels does information actually leave by, and which of them does your policy not mention?

Typical evidence

Information transfer policy or procedure covering electronic, physical and verbal transfer; channel rules by classification level; encryption settings for email and file transfer; file-sharing configuration and link expiry settings; data-sharing agreements, NDAs and operator agreements; courier and removable-media records; bank detail change verification procedure; POPIA section 72 basis for offshore transfers.

How to comply — recommendations

List the channels information actually leaves by — email, file-sharing, messaging, portals, USB, courier, phone — and write one table stating which classification levels may use each, with conditions such as encryption, link expiry or recipient verification. Configure the tools to match: default sharing to named people, set link expiry, restrict USB storage. Put security clauses in contracts and data-sharing agreements, and section 21 terms in operator agreements. Require a call-back on a known number before any change to banking details is accepted. Brief staff on discretion in public places and on calls. Review the table whenever a new channel is adopted.

Common nonconformities

No transfer rules, or rules covering email only; confidential information sent through unapproved channels such as personal messaging apps; file-sharing links open to anyone; no agreements with parties receiving personal or confidential information; operator agreements without security terms; changed banking details accepted without verification; unencrypted removable media; offshore transfers with no POPIA section 72 basis.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.