ISO 27001 Annex : A.13.2 Information Transfer

ISO 27001 Annex : A.13.2 Information Transfer Its objective is to maintain the security of information transferred to any external entity and within the organization.

A.13.2.1 Information Transfer Policies and Procedures

Control- In order to protect the transferees by using all types of communication facilities, official transfer policies, procedures and controls should be developed.

Implementation guidance – The following items should be addressed in the procedures and controls required to use communications facilities to transmit information:

Procedures to prevent interception, copying, altering, misrouting or destruction of transmitted information;
Procedures to detect and protect malware from electronic communications which can be transmitted;
Procedures for the protection of communicated electronically sensitive information in the form of an attachment;
Guidelines or rules specifying an appropriate usage of communication facilities (refer to 8.1.3);
The moral duty of, external party and the other user not to compromise, e.g., defamation, harassment, impersonation, transmission of chain letters, unauthorized purchase-out, etc.;
Use of encryption techniques, for example, to protect confidentiality, information integrity and authenticity (refer Clause 10);
retaining and disposing of guidelines in compliance with national and native legislation and regulations for all business correspondence, including messages;
controls and constraints relating to the use of communication facilities, such as electronic mail automatic forwarding to external mail addresses;
advise employees not to share personal details and take sufficient precautions;
Do not leave messages that contain sensitive information regarding answering machines, because they can be replayed by unauthorized individuals, stored or wrongly stored as a result of wrong dialing;
Advising staff on issues concerning the use of fax machines or services, in particular:

Unauthorized access for message retrieval to built-in message stores;
deliberate or unintended computer programming to transmit messages to particular numbers;
either misdial or use the wrong stored number to send documents and messages to the wrong number

Furthermore, workers should not have publicly confidential discussions or through unreliable communication networks, open offices and meeting places.

Services of information transfer should meet all relevant legal requirements.

Other Information – Different kinds of communication facilities, including electronic mail, voice, facsimile and video, can lead to the transfer of information.

The transfer of software may occur through a variety of various media, including Internet downloads and purchases of off-shell products by suppliers.

The implications of business, legal and security related to electronic data exchange, electronic commerce, and electronic communications and control requirements should be taken into account.

A well-known ISO 27001 Lead Auditor and ISO 27001 Lead Implementer certificate that mainly covers information security clauses and their implementation, i.e., controls which should be implemented by the organization to preserve the CIA triad, Confidentiality, Integrity, and Availability to maintain their critical, sensitive information in a secure manner. Infosavvy, a Mumbai- based institute, provides multi-domain certifications and training, which include IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification). Infosavvy will help you to understand and recognize the full scope of your organization’s security checks to protect your organization’s activities and information equipment (assets) from attacks, and also to illustrate the backup policy to safeguard if data gets lost due to intentional or natural hazards. It also helps you understand how to control or manage the integrity of the operating system and software when they are been transferred from one system to the other or even outside the organization. We have trainers with extensive expertise and experience to ensure the efficient handling of the security of information. Consequently, the applicant will gain the necessary skills for the ISMS audit by using commonly agreed audit concepts, procedures and techniques

Also Read : ISO 27001 Annex : A.13 Communications Security

A.13.2.2 Agreements on Information Transfer

Control- Agreements should address secure transfers between the organization and outside parties of business information.

Implementation Guidance – The following will be included in the information transfer agreements:

Management of transmission, dispatch and receipt control and notification responsibilities;
procedures for ensuring traceability and non-repudiation;
Minimum packaging and transmission technical standards;
escrow agreements;
standards of courier identification;
In the event of data security incidents, including data loss, responsibilities and liabilities;
Use the agreed labeling system to ensure that the meaning of the labels is understood and that the information is properly protected for sensitivity or criticality
software and information recording and reading technical standards;
Special controls to protect sensitive things such as cryptography are required;
Keeping a custody chain in transit for information;
Appropriate levels of control of access

In order to secure information and physical resources in transit (see 8.3.3), policies, protocols, and guidelines should be set and maintained and referred to in those transfers.

The content of any contract for information protection should represent the sensitivity of the information.

Other Information – Agreements may be electronic or manual, and formal contracts may take the form. For confidential information, all organizations and types of agreements must be consistent with the particular mechanisms used for transferring such information.

Questions related to this topic

How do you write an information transfer?
Explain controls of ISO 27001 Annex : A.13.2 Information Transfer?
What is information transfer in writing skills?
What are the forms of information transfer?
What is mean by verbal to nonverbal?
Explain ISO 27001 Annex : A.13.2 Information Transfer?

ISO 27001 Requirements

Clause 4.2 Understanding the needs and expectations of interested parties

Clause 4.4 Information security management system
Clause 4.3 Determining the scope of the information security management system
Clause 5.1 Leadership and commitment
Clause 5.2 Policy
Clause 5.3 Organizational roles, responsibilities and authorities
Clause 6.1 Actions to address risks and opportunities
Clause 6.1.2 Information security risk assessment process
Clause 6.1.3 Information security risk treatment
Clause 6.2 Information security objectives & planning
Clause 7.1 Resources
Clause 7.2 Competence
Clause 7.3 Awareness
Clause 7.4 Communication
Clause 7.5 Documented information Implementation Guideline
Clause 8.1 Operational planning & control
Clause 8.2 Information security risk assessment
Clause 8.3 Information security risk treatment
Clause 9.1 Performance evaluation Monitoring, measurement, analysis & evaluation
Clause 9.2 Internal audit
Clause 9.3 Management review
Clause 10.1 Non conformity and corrective action
Clause 10.2 Continual Improvement

ISO 27001 Annex A Controls

About ISO 27002

This Blog Article is posted by
Infosavvy, 5B 306 Riverside Greens, Panvel, Raigad 410206 Maharashtra, India

Contact us – www.infocerts.com

https://goo.gl/maps/mHkyURHmeFXyGiVw5