ISO 27001 Annex A 5.10 Acceptable use policies for information and assets
What it says
Rules for the acceptable use and procedures for handling information and other associated assets shall be identified, documented and implemented.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate and communicate rules for how information and assets should be used to ensure security.
This control is about setting clear rules on how everyone in the organisation should use information and company resources, like computers and data. It's important because if people misuse these resources, it can lead to data breaches or loss, which can be costly and damaging to the organisation's reputation.
Free. Save your status, tasks and notes.
Why it matters
Without acceptable use rules, staff may mishandle information or assets, causing data leakage, malware infection, and regulatory or reputational damage.
How to implement
The IT manager should develop an acceptable use policy that clearly outlines what is considered appropriate and inappropriate use of information and equipment.
This can be done by listing specific do's and don'ts and aligning them with security guidelines from ISO 27002:2022.
HR should ensure that all employees and external partners are aware of the acceptable use policy.
This involves including these guidelines in the onboarding process and having employees sign off that they understand the policy.
The IT department should set up monitoring systems to track adherence to the acceptable use policy.
This can be done by using log files and alerts that indicate unusual access or misuse of assets to help identify potential security threats.
Management should regularly review and update the acceptable use policy to ensure it remains relevant.
This might involve consulting with IT and compliance specialists to incorporate changes in the regulatory landscape like updates from the Privacy Act 1988.
The IT manager should implement a clear procedure for handling violations of the acceptable use policy.
This could include disciplinary actions or additional training sessions to prevent future breaches.
Keep it running
Review and train on acceptable use for email, internet, cloud apps, BYOD and remote work; define prohibited actions, monitoring, and sanctions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request a copy of the acceptable use policy document.
Look at
Check that the policy clearly outlines acceptable and unacceptable behaviours and includes procedures for handling breaches.
Good evidence
The policy is comprehensive, clearly communicated, signed by employees, and includes regular updates that align with current regulations.
- Check 2 of 5What an auditor asks for
Ask for
Ask to see records of employee acknowledgements of the acceptable use policy.
Look at
Ensure acknowledgements are signed and dated by all employees and any external partners with access.
Good evidence
All employees and relevant partners have signed acknowledgments within an appropriate timeframe after policy updates.
- Check 3 of 5What an auditor asks for
Ask for
Request evidence of monitoring activities related to policy compliance.
Look at
Check for logs or reports that show how IT monitors for policy compliance and any incidents of misuse.
Good evidence
There are consistent and thorough monitoring processes in place, with incidents being recorded and dealt with promptly.
- Check 4 of 5What an auditor asks for
Ask for
Inquire about the training materials or sessions that cover the acceptable use policy.
Look at
Verify that the training content explicitly covers the acceptable use policy and includes scenarios or examples.
Good evidence
Training is comprehensive, up-to-date, and participation is well-documented.
- Check 5 of 5What an auditor asks for
Ask for
Ask for records of any incidents and how they were addressed with respect to the acceptable use policy.
Look at
Look for documentation showing the response to policy violations, including any remediation steps taken.
Good evidence
Incidents are documented clearly with actions taken, showing a proactive approach to handling breaches and policy reinforcement.
Mappings
Closest match in ASD Information Security Manual: ISM-0161, Ensure security of unused IT equipment and media, which this control covers in full and more.
ISO/IEC 42001: 5 mappings
This control partially overlaps A.2.3.
Annex A 2.3 requires identifying which existing policies are impacted by or constrain AI objectives. Annex A 5.10 establishes acceptable-use rules for information and assets, which AI use (e.g., prompting, data entry, tool usage) can directly affect. The overlap is that AI objectives commonly necessitate updating acceptable-use rules, but Annex A 5.10 is a specific policy topic rather than an organisation-wide alignment requirement.
This control partially overlaps A.9.2.
Annex A 9.2 requires the organisation to define and document processes for responsible AI use, including how AI tools should and should not be used. Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets, which can overlap where AI use affects data handling, prompts, outputs, and use of AI services as an organisational asset. Annex A 5.10 is not AI-specific and may omit AI lifecycle concerns (e.g. model limitations, human oversight), while Annex A 9.2 is not limited to information-security acceptable use.
This control partially overlaps A.10.3.
Annex A 10.3 requires a supplier-usage process so that external services/products/materials used for AI align with responsible AI practices. Annex A 5.10 relates where supplier-provided AI tools (e.g., SaaS GenAI, model APIs) are treated as organisational assets and their acceptable use and handling rules constrain how personnel can use them responsibly. Annex A 5.10 is primarily about user behaviour and asset handling, whereas Annex A 10.3 is about supplier assurance and governance of third-party AI inputs and services.
This control depends on A.7.2.
Annex A 7.2 requires the organisation to implement defined processes for managing data used in AI development and enhancement. ISO/IEC 27001:2022 Annex A 5.10 supports this by mandating acceptable use and handling procedures for information and assets, which can be extended to cover AI datasets, feature stores and data labelling environments. Annex A 5.10 is policy/behaviour focused and applies generally, while Annex A 7.2 is more specific to the end-to-end AI data management lifecycle.
This control depends on A.9.4.
Annex A 9.4 requires the organisation to ensure the AI system is used only in the ways it was designed and approved for, consistent with its documentation. Annex A 5.10 supports this by requiring acceptable use rules for information and assets, which can codify permitted and prohibited AI uses (e.g., banning use for hiring decisions if not approved). Annex A 5.10 applies across all assets, whereas Annex A 9.4 is specific to AI system intended-use constraints.
ASD Information Security Manual: 29 mappings
This control is broader than ISM-0161.
ISM-0161 requires organisations to ensure IT equipment and media are secured whenever they are not in use. ISO/IEC 27001:2022 Annex A 5.10 supports this by establishing acceptable use and handling rules for assets (including removable media), which can mandate behaviours like secure storage, not leaving devices unattended, and following secure handling procedures. Annex A 5.10 is policy/governance-oriented and broader, while ISM-0161 is a specific physical security outcome for unused equipment/media.
This control is broader than ISM-0240.
ISM-0240 requires that paging, MMS, SMS and messaging apps are not used to communicate sensitive or classified data. Annex A 5.10 requires the organisation to define and implement acceptable use rules and handling procedures for information and associated assets, which is the governance mechanism that would include banning sensitive data use in consumer messaging services. ISM-0240 is a specific, channel-focused prohibition, while Annex A 5.10 is broader policy coverage across many asset and information usage scenarios.
This control is broader than ISM-0258.
Annex A 5.10 requires organisations to identify, document and implement rules for acceptable use and handling of information and associated assets. ISM-0258 fits within this by mandating a specific acceptable-use policy for web browsing and related information handling behaviours. ISM-0258 is narrower in scope (web usage only), while Annex A 5.10 covers acceptable use across all information assets and usage contexts.
This control is broader than ISM-0264.
Annex A 5.10 requires organisations to document and implement rules for acceptable use and handling of information and assets. ISM-0264 aligns as it mandates an email usage policy, covering acceptable behaviour and handling expectations for a key communication channel. ISM-0264 is narrower (email only), while Annex A 5.10 covers acceptable use and handling across all channels and asset types.
This control is broader than ISM-0337.
ISM-0337 requires media to only be used with systems authorised to process, store or communicate the media's sensitivity or classification. Annex A 5.10 supports this by requiring documented acceptable-use and handling procedures, which formalises rules on where classified media may be used. Annex A 5.10 is broader and policy-focused, while ISM-0337 is operational.
This control is broader than ISM-0358.
ISM-0358 requires that sanitised SECRET/TOP SECRET EPROM/EEPROM media continues to be handled as classified, affecting how staff may store, transport, and dispose of that media. Annex A 5.10 requires rules for acceptable use and procedures for handling information and associated assets. Annex A 5.10 supports ISM-0358 by being the vehicle for communicating and enforcing handling rules (e.g., prohibiting disposal as unclassified waste), but Annex A 5.10 is generic and does not contain ISM-0358's technology- and classification-specific constraint.
This control is broader than ISM-0588.
Annex A 5.10 requires documented and implemented rules for acceptable use and handling of information and other assets. ISM-0588 relates by requiring an MFD usage policy, addressing acceptable use and handling risks specific to multifunction devices that process, store, or transmit information. ISM-0588 is narrower in scope (MFDs), while Annex A 5.10 covers acceptable use across all asset categories and usage contexts.
This control is broader than ISM-0824.
ISM-0824 advises personnel not to send or receive files via unauthorised online file services to reduce security risk. Annex A 5.10 requires the organisation to define, document and implement acceptable use rules and handling procedures for information and associated assets, under which prohibiting unapproved file-sharing services would typically sit. ISM-0824 is a specific acceptable-use rule about a particular class of services, whereas Annex A 5.10 is broader and covers many acceptable-use and handling topics beyond online file services.
This control is broader than ISM-0870.
ISM-0870 requires that mobile devices are carried or stored in a secured state when not being actively used, setting an operational security expectation for users. Annex A 5.10 supports this by requiring documented acceptable use and handling procedures for information and assets, which is the mechanism organisations typically use to define and enforce behaviours like locking, securing, and safely storing mobile devices. Annex A 5.10 is policy/procedure-oriented, while ISM-0870 is a specific handling requirement for mobile devices.
This control is broader than ISM-1078.
Annex A 5.10 requires documented and implemented acceptable use rules for information and associated assets. ISM-1078 relates by requiring a telephone system usage policy, which is one channel where acceptable use and handling rules must be defined. ISM-1078 is a subset focused on telephony, whereas Annex A 5.10 applies broadly to all asset types and usage scenarios.
This control is broader than ISM-1146.
ISM-1146 advises personnel to keep separate work and personal online accounts to reduce cross-contamination and account compromise risks. Annex A 5.10 requires the organisation to define and implement acceptable use rules for information and associated assets, which commonly includes requirements about use of personal vs organisational accounts for online services. ISM-1146 is a specific, practical behavioural rule that would typically sit under the broader acceptable use policy framework in Annex A 5.10.
This control is broader than ISM-1187.
ISM-1187 requires a procedural check during manual export to ensure data does not have unsuitable protective markings. Annex A 5.10 requires documented acceptable use rules and handling procedures for information and assets, which is where an organisation would define how protective markings must be applied/validated and how exports are to be performed. Annex A 5.10 does not mandate the specific 'check before export' step, but it supports ISM-1187 by establishing the governance and handling expectations that make such checks consistent and enforceable.
This control is broader than ISM-1359.
ISM-1359 requires an organisation to develop, implement and maintain a removable media usage policy to manage the risks of using removable storage. Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets, which would typically include removable media as an asset class. ISM-1359 is more specific (removable media-focused), while Annex A 5.10 is broader across many asset types and usage scenarios.
This control is broader than ISM-1599.
ISM-1599 requires IT equipment to be handled in a manner suitable for its sensitivity or classification. ISO/IEC 27001:2022 Annex A 5.10 mandates documented rules for acceptable use and handling of information and associated assets, including IT equipment. Annex A 5.10 covers a broader range since it applies to various asset types, not just IT equipment.
This control is broader than ISM-1644.
ISM-1644 requires that sensitive or classified phone calls and conversations are not conducted in public locations unless precautions are taken to prevent being overheard. Annex A 5.10 requires organisations to define and implement acceptable use rules and handling procedures for information and associated assets, which can include rules about verbal discussions and mobile phone use in public. ISM-1644 is a specific behavioural/operational rule about spoken communications, while Annex A 5.10 is broader policy coverage across many asset and information handling scenarios.
This control is broader than ISM-1864.
Annex A 5.10 requires organisations to define and implement acceptable-use rules and handling procedures for information and other assets. ISM-1864 directly contributes by requiring a system usage policy that sets expectations and constraints for how systems (and the information they process) are used. ISM-1864 is narrower because it focuses on system use, while Annex A 5.10 also covers other asset classes and handling procedures beyond system interaction.
This control is broader than ISM-2074.
Annex A 5.10 requires organisations to set and implement acceptable use rules for information and assets. ISM-2074 maps as a specific acceptable-use policy area by mandating a general-purpose AI usage policy governing how personnel use AI tools in ways that can affect information handling and access. ISM-2074 is narrower (AI tool usage), whereas Annex A 5.10 encompasses acceptable use rules for all relevant technologies and assets.
This control is broader than ISM-2075.
ISM-2075 prohibits organisations from using fax machines or online fax services to send or receive fax messages. ISO/IEC 27001:2022 Annex A 5.10 requires documented acceptable use rules for information and associated assets, under which a prohibition on faxing would typically be specified and enforced. Annex A 5.10 is broader because it covers acceptable use across many asset types and channels, while ISM-2075 is a single, explicit restriction on fax as a communication method.
This control is broader than ISM-2095.
ISM-2095 requires personnel using privately owned devices to access sensitive/protected environments to not grant access to unapproved AI agents. ISO/IEC 27001:2022 Annex A 5.10 requires documented acceptable use and handling rules for information and assets, which commonly includes prohibitions on using unapproved tools/services (including AI assistants) with sensitive data. ISM-2095 is a specific acceptable-use restriction targeted at AI agent access in a BYOD scenario, while Annex A 5.10 is a broader umbrella for acceptable-use requirements across many asset types and use cases.
This control is broader than ISM-2105.
ISM-2105 requires personnel to limit posting information about their work-related duties on unauthorised online services and to report when it occurs. ISO/IEC 27001:2022 Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets to be identified, documented and implemented. ISM-2105 is a specific acceptable-use/handling rule focused on public/online posting behaviour, while Annex A 5.10 is broader and would cover many other acceptable-use scenarios and assets.
This control is broader than ISM-2106.
ISM-2106 requires advising staff not to disclose work skills/experience on unauthorised online services and to report when it occurs. ISO/IEC 27001:2022 Annex A 5.10 requires documented and implemented acceptable use rules for handling information and associated assets, which can include rules about what staff may publish externally about their roles. ISM-2106 is a specific acceptable-use/OPSEC behaviour expectation, while Annex A 5.10 is broader and covers acceptable use across many information and asset handling scenarios.
This control partially overlaps ISM-0348.
ISM-0348 requires organisations to develop, implement, and maintain media sanitisation processes and supporting procedures. ISO/IEC 27001:2022 Annex A 5.10 requires acceptable use rules and procedures for handling information and associated assets, which commonly includes requirements for handling and disposing of storage media securely (including sanitisation prior to reuse or disposal). Annex A 5.10 is broader (acceptable use and handling generally), while ISM-0348 goes deeper on the specific life-cycle activity of sanitising media and maintaining dedicated sanitisation procedures.
This control partially overlaps ISM-1083.
Annex A 5.10 requires organisations to document and implement acceptable use rules and handling procedures for information and assets. ISM-1083 overlaps by requiring personnel to be advised about what sensitivity/classification is permitted over mobile voice and data, which is an acceptable-use constraint for a particular communication context. ISM-1083 is more narrowly focused on classification guidance for mobile communications, while Annex A 5.10 additionally covers broader acceptable-use rules and asset handling procedures beyond mobile devices.
This control partially overlaps ISM-1549.
Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets to be documented and implemented. ISM-1549 overlaps by requiring a media management policy, which is a concrete set of handling procedures for a specific asset category (removable/physical media). ISM-1549 goes deeper into media governance, while Annex A 5.10 is broader and covers acceptable use beyond media (e.g. user conduct across systems and services).
This control partially overlaps ISM-1551.
ISM-1551 requires an organisation to maintain an IT equipment management policy to govern how IT equipment is handled and controlled. Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets, which overlaps with equipment management where acceptable use, custody, and handling of devices are defined. ISM-1551 is broader across the equipment lifecycle (e.g., allocation, maintenance, disposal), while Annex A 5.10 also covers information handling beyond equipment.
This control partially overlaps ISM-2104.
ISM-2104 requires personnel not to post security clearance and briefing details on unauthorised online services and to report when this occurs. ISO/IEC 27001:2022 Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets, which would commonly include restrictions on publishing sensitive organisational/personnel information to public or unauthorised platforms. ISM-2104 is narrower and explicitly about security clearance/briefing details, while Annex A 5.10 is broader across many information types and asset-handling situations.
This control supports ISM-0661.
ISM-0661 requires user accountability for data transfers across systems. Annex A 5.10 requires documented acceptable use and handling rules for information and associated assets, defining the permitted transfer methods and user obligations when moving data. This supports ISM-0661 by clarifying expectations and enabling accountability through policy. Annex A 5.10 does not require attribution of transfers to specific users.
This control supports ISM-1865.
ISM-1865 requires personnel to agree to abide by system usage policies before they are granted access to systems and resources. Annex A 5.10 requires the organisation to identify, document and implement acceptable use rules and handling procedures, which provides the concrete 'system usage policies' that users must agree to under ISM-1865. Without acceptable use rules in place, ISM-1865 cannot be meaningfully implemented as there is nothing specific to agree to.
This control supports ISM-1868.
ISM-1868 requires that removable media is not used on SECRET and TOP SECRET mobile devices unless ASD approval is obtained beforehand. Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets, which would normally codify prohibitions and the conditions under which removable media may be used. ISM-1868 is a specific classified-device rule, while Annex A 5.10 provides the organisational acceptable-use framework needed to communicate and operationalise that rule.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.
Draft your ISO 27001 documentation