Skip to content
Data transfers
ASD ISMISM-0663

ASD ISM 0663 Develop and maintain data transfer procedures

What it says

Data transfer processes, and supporting data transfer procedures, are developed, implemented and maintained.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure data transfers are securely conducted with proper procedures in place.

This control is about making sure that when you move data from one place to another, it's done safely and securely. If the process isn't secure, sensitive data could be exposed to wrong parties, leading to privacy breaches, financial loss, or damage to your business's reputation.

Why it matters

Insecure data transfers can leak sensitive information in transit, leading to privacy breaches, legal penalties and reputational harm.

How to implement

  1. IT manager should develop a written plan for data transfers, outlining the specific steps required and tools to use.

    This plan should detail how to securely send information, such as using encryption and secure connections.

  2. Office manager should train staff on the new data transfer procedures.

    Organise a session where you explain why secure data transfer is important and demonstrate how to follow the procedures correctly.

  3. HR should include data transfer requirements in employee contracts and policies.

    Make sure all employees sign off on understanding these procedures as part of their onboarding process.

  4. IT team should regularly update software used for data transfers to ensure security.

    This includes installing updates or patches for any tools or platforms used in the process, as outdated systems can be vulnerable to attacks.

  5. Business owner should review the data transfer procedures annually.

    You could set a calendar reminder to check if the processes are still effective and make improvements based on any incidents or technological changes.

Keep it running

Maintain documented transfer procedures (methods, encryption, approvals and recipients) and review them regularly to address new threats and changes.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The documented data transfer procedure manual: Request to see the written guidelines that describe the data transfer process.

    Look at

    The steps included for their clarity and thoroughness.

    Good evidence

    Includes a well-organised document that specifies tools, encryption standards, and roles.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Training records: Request documentation showing when and how employees were trained on data transfer procedures.

    Look at

    Dates, names of participants, and training material.

    Good evidence

    Is a comprehensive list showing regular training sessions attended by all staff.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Records showing that data transfers were checked for compliance with the procedures.

    Look at

    The frequency of audits and any actions taken from findings.

    Good evidence

    Is an audit log showing timely reviews and documented responses to any issues found.

  4. Check 4 of 5What an auditor asks for

    Ask for

    IT maintenance logs: These should detail updates and patches applied to software used for data transfers.

    Look at

    The timing and frequency of updates.

    Good evidence

    Is a log showing regular updates in line with the latest security recommendations.

  5. Check 5 of 5What an auditor asks for

    Ask for

    A policy review schedule: Request the timeline or calendar for reviewing and updating data transfer procedures.

    Look at

    Evidence that reviews are planned and happen consistently.

    Good evidence

    Includes a clear schedule with past and future review dates.

Mappings

Closest match in ISO/IEC 27001: A.5.14, Information transfer policies and procedures, which asks for the same thing.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.14Information transfer policies and proceduresEquivalent

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.