Intellectual property rights

Plain-language summary

Protecting intellectual property — your own and other people's — with procedures that keep software properly licensed and used within its terms, respect copyright in documents, images and code, and stop proprietary information being copied or used without permission.

What the clause is really asking

Most audits of this control come down to software licensing, but the control is broader. It asks you to implement procedures that protect intellectual property rights. That covers acquiring software and content only from legitimate sources; keeping proof of ownership and licence terms; staying within licence limits (number of users, installations, cores, permitted use); controlling installation so staff cannot add unlicensed software; respecting copyright in books, standards, images, fonts and code, including open-source licence conditions in software you build or distribute; and protecting your own intellectual property, such as designs, source code and customer lists, through classification, access control and agreements. The common misunderstanding is that cloud subscriptions remove licence risk. They move it to user counts, shared accounts and terms of use. In South Africa the Copyright Act 98 of 1978 applies, and software publishers' licence audits can bring large back-billing claims. For manufacturers, customer drawings and tooling data are someone else's intellectual property held under contract, and the customer's terms govern how you store and share them.

What auditors look for

Auditors ask for the software licence register and compare it with what is installed and in use, often by sampling a few laptops and the cloud admin consoles. They look for software with no licence record, user counts above what was bought, shared logins on per-user licences, and free software used commercially against its terms. They ask how installation rights are controlled. Where you develop software they ask how open-source licences are checked. They also ask how your own and your customers' intellectual property is protected. The hard question: how many licences of your main design or office software do you own, and how many are installed?

Typical evidence

Intellectual property policy or section of the acceptable-use policy; software licence register with proof of purchase and terms; software inventory reconciled against licences; installation controls and approved software list; open-source licence review records for developed software; confidentiality and intellectual property clauses in employment and supplier contracts; licences for copyright material such as standards, fonts and images.

How to comply — recommendations

Create a software licence register that records each product, licence type, quantity, proof of purchase and renewal date, and reconcile it against your endpoint management and cloud admin data twice a year. Remove local admin rights so that installation goes through IT and an approved software list. Cover intellectual property in the acceptable-use policy: no unlicensed software, no copying of copyrighted material, respect for customer property. Check that employment contracts and supplier agreements contain intellectual property and confidentiality clauses. If you develop software, run an open-source licence check before each release. Keep licence evidence somewhere that survives staff turnover.

Common nonconformities

No software licence register or proof of purchase; installed or used software exceeding licences held; users able to install software freely; free or trial software used commercially against its terms; open-source licence obligations ignored in distributed software; copies of purchased standards or documents shared internally beyond the licence; employment contracts silent on ownership of intellectual property.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.