ISO 27001 Control A.5.10: Acceptable Use of Information and Other Associated Assets

Every organization has rules about how people may use its laptops, email, cloud tools and data. The question is whether those rules are written down, understood and sensible. An acceptable use policy that runs to twelve pages of legal language and is signed on day one and forgotten by day two does little for security. A short, plain set of rules that people can recall, that explains why, and that matches how they really work does a great deal. A.5.10 is the tenth of 37 organizational controls in Annex A.

This control follows naturally from the inventory we covered last time. Once you know what your assets are and who owns them, you need to say how they may be used and handled.

What the control requires

Annex A control 5.10 of ISO 27001:2022 states that rules for the acceptable use and procedures for handling information and other associated assets shall be identified, documented and implemented.

The key elements:

Rules for acceptable use - what people may and may not do with information, devices, systems and services
Procedures for handling - how information and assets are processed, stored, transmitted, copied and destroyed in practice
Information and other associated assets - the same broad scope as the inventory of information and other associated assets
Identified, documented and implemented - worked out from your risks, written down, and genuinely in use

A.5.10 is a preventive control in ISO/IEC 27002:2022. It reduces the chance that assets are misused by mistake or by design. Annex A states the control; ISO 27002 gives guidance, including that personnel and external users who use or have access to the organization’s assets should be made aware of the information security requirements, and that they should be responsible for their use of any information processing facilities. Handling procedures can follow the classification of the information, covered in the controls that come next in the series.

How to implement acceptable use and handling rules

Start from real risks and real behavior

Walk through how people actually use assets and where things go wrong. Typical subjects for acceptable use rules include:

Use of company devices for personal activity
Personal devices used for work
Email, messaging and social media
Internet use and downloads
Cloud storage and file sharing tools, including unapproved ones
Installation of software
Use of removable media
Protection of passwords and other credentials
Use of generative AI tools with company or customer information
Working outside the office, covered in more depth in remote working

Ask a few people from different teams what they do today. The gap between the rule you would like and the practice you have is where problems live, and you will want to close it with a better rule or a better tool, not a stricter sentence.

Write for humans

Keep the main rules short, concrete and in plain language. For each, explain the reason in a few words, because people follow rules they understand. Compare:

“Users shall not store organizational data on unapproved cloud services.”
“Keep company files in our approved storage, not personal accounts. Personal accounts are outside our control, and files in them can be lost or shared without anyone knowing.”

The second version is easier to follow, easier to teach, and easier to enforce fairly. Aim for a one or two page core document that applies to everyone, supported by specific procedures for particular assets or teams. Align it with the rest of your policies for information security so the hierarchy is clear.

Add handling procedures

Rules say what is allowed; procedures say how to do it correctly. For information that needs more care, describe handling steps for each stage of its life: creating, storing, sending, sharing, printing, copying, archiving and destroying. Examples include how to send sensitive documents to customers, how to take notes in a client workshop, what to do with printouts, and how to dispose of storage media. Our posts on clear desk and clear screen, storage media and security of assets off-premises show how these handling rules look for physical settings.

You can scale procedures to the sensitivity of the information. Public material needs few rules; customer data, personal data and credentials need more. Where your organization uses classification labels, tie handling instructions to each label so that people only have to remember one thing: the label tells them what to do.

Communicate, acknowledge and train

Rules that nobody has read cannot be implemented. Give them to every new joiner and contractor, include them in terms and conditions of employment or the equivalent agreement, collect an acknowledgement, and refresh it periodically. Cover the key rules in information security awareness, education and training with scenarios drawn from your own work. Managers play a central role here, as discussed in management responsibilities.

Monitor and enforce fairly

Decide what monitoring is appropriate and lawful, and tell people about it. Monitoring of employee activity is regulated in many places, so take legal advice on what you may log and how you inform staff. Apply consequences consistently using the disciplinary process, with a distinction between honest mistakes and deliberate misuse. Provide a route to ask for exceptions, because a rule with no legitimate way around it tends to be broken quietly.

Review the rules

Technology and habits move quickly. A rule written before your team adopted a new collaboration tool or an AI assistant may already be out of date. Review acceptable use rules at least annually and whenever you introduce a major new tool or after an incident that shows a gap. Treat the document under your normal document control, as described in clause 7.5.3, Control of documented information.

A.5.1 connection. Policies for information security provides the framework in which acceptable use rules sit.

A.5.4 connection. Management responsibilities requires managers to see that the rules are applied.

A.5.9 connection. Inventory of information and other associated assets defines the assets these rules cover.

A.6.4 connection. Disciplinary process is the fair route when rules are broken.

A.6.7 connection. Remote working extends the rules to home and mobile settings.

A.7.7 connection. Clear desk and clear screen is a concrete example of an acceptable use rule.

Clause 7.3 connection. Awareness requires people to know the policy and their contribution to it.

Forward reference. Return of assets, classification of information and labelling of information, covered next, complete the picture of how assets are handled across their life.

What auditors check

Documented rules. Auditors ask for the acceptable use policy and any handling procedures, and look at whether they cover the main asset types and risks.

Staff understanding. They interview people from different teams and ask how they would handle a particular situation, such as sending a sensitive file or using a personal phone.

Acknowledgement. Signed or recorded confirmations from new starters and contractors show rules are communicated.

Alignment with practice. If staff routinely use tools the policy does not mention, auditors notice.

Handling by classification. Where classification exists, they look for handling instructions tied to each level.

Enforcement. Records of how breaches were handled, anonymized where appropriate, show the rules have consequences.

Common mistakes to avoid

Copy-pasted legal text. A policy nobody understands cannot be followed or enforced.

Rules with no reasons. People ignore what feels arbitrary. A single sentence of explanation helps a lot.

Banning what people need. If the approved route is painful, staff will find another. Provide good tools along with the rules.

Forgetting contractors and visitors. They use your assets too and need the same rules, with an acknowledgement.

Out-of-date content. Rules that ignore current tools, such as AI services or messaging apps, lose credibility.

One-off signing. Acknowledgement on day one with no refresher leaves the policy to fade.

How 27kay can help

We help organizations replace dense policy text with short, practical rules and handling guides that fit the way people work. As part of ISO 27001 implementation, we draft or simplify your acceptable use rules, connect them to training and onboarding, and prepare the evidence auditors ask for. For the full picture, see our ISO 27001 knowledge hub.

Could every member of your team explain, in two sentences, what they may and may not do with company data? Get in touch - we will help you write rules they will want to follow.