verifiedISO/IEC 27001:2022
ISO 27001 Annex A 5.10Acceptable Use Policies for Information and Assets
Official control statement
Rules for the acceptable use and procedures for handling information and other associated assets shall be identified, documented and implemented.
verifiedISO/IEC 27001:2022Annex A 5.10
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Create and communicate rules for how information and assets should be used to ensure security.
Organisational controlsISO/IEC 27001:2022
record_voice_over
What this means in practice
This control is about setting clear rules on how everyone in the organisation should use information and company resources, like computers and data. It's important because if people misuse these resources, it can lead to data breaches or loss, which can be costly and damaging to the organisation's reputation.
01 - Overview
Framework
ISO/IEC 27001:2022
Control effect (Control Stack)
Preventative
ISO 27001 domain
Organisational controls
Classifications
N/A
Official last update
24 Oct 2022
Control Stack last updated
29 Sept 2026
priority_high
Why it matters
Without acceptable use rules, staff may mishandle information or assets, causing data leakage, malware infection, and regulatory or reputational damage.
settings
Operational notes
Review and train on acceptable use for email, internet, cloud apps, BYOD and remote work; define prohibited actions, monitoring, and sanctions.
02 - Implement
build
Implementation tips
- The IT manager should develop an acceptable use policy that clearly outlines what is considered appropriate and inappropriate use of information and equipment. This can be done by listing specific do's and don'ts and aligning them with security guidelines from ISO 27002:2022.
- HR should ensure that all employees and external partners are aware of the acceptable use policy. This involves including these guidelines in the onboarding process and having employees sign off that they understand the policy.
- The IT department should set up monitoring systems to track adherence to the acceptable use policy. This can be done by using log files and alerts that indicate unusual access or misuse of assets to help identify potential security threats.
- Management should regularly review and update the acceptable use policy to ensure it remains relevant. This might involve consulting with IT and compliance specialists to incorporate changes in the regulatory landscape like updates from the Privacy Act 1988.
- The IT manager should implement a clear procedure for handling violations of the acceptable use policy. This could include disciplinary actions or additional training sessions to prevent future breaches.
03 - Audit
fact_check
Audit / evidence tips
- AskRequest a copy of the acceptable use policy document.Look atCheck that the policy clearly outlines acceptable and unacceptable behaviours and includes procedures for handling breaches.GoodThe policy is comprehensive, clearly communicated, signed by employees, and includes regular updates that align with current regulations.
- AskAsk to see records of employee acknowledgements of the acceptable use policy.Look atEnsure acknowledgements are signed and dated by all employees and any external partners with access.GoodAll employees and relevant partners have signed acknowledgments within an appropriate timeframe after policy updates.
- AskRequest evidence of monitoring activities related to policy compliance.Look atCheck for logs or reports that show how IT monitors for policy compliance and any incidents of misuse.GoodThere are consistent and thorough monitoring processes in place, with incidents being recorded and dealt with promptly.
- AskInquire about the training materials or sessions that cover the acceptable use policy.Look atVerify that the training content explicitly covers the acceptable use policy and includes scenarios or examples.GoodTraining is comprehensive, up-to-date, and participation is well-documented.
- AskAsk for records of any incidents and how they were addressed with respect to the acceptable use policy.Look atLook for documentation showing the response to policy violations, including any remediation steps taken.GoodIncidents are documented clearly with actions taken, showing a proactive approach to handling breaches and policy reinforcement.
04 - Mappings
link
Cross-framework mappings
How Annex A 5.10 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 42001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(3)expand_less | ||
| Annex A 10.3 | Annex A 10.3 requires a supplier-usage process so that external services/products/materials used for AI align with responsible AI practices | |
| Annex A 2.3 | Annex A 2.3 requires identifying which existing policies are impacted by or constrain AI objectives | |
| Annex A 9.2 | Annex A 9.2 requires the organisation to define and document processes for responsible AI use, including how AI tools should and should n... | |
extensionDepends on(2)expand_less | ||
| Annex A 7.2 | Annex A 7.2 requires the organisation to implement defined processes for managing data used in AI development and enhancement | |
| Annex A 9.4 | Annex A 9.4 requires the organisation to ensure the AI system is used only in the ways it was designed and approved for, consistent with ... | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
open_in_fullBroader than(21)expand_less | ||
| ISM-0161 | ISM-0161 requires organisations to ensure IT equipment and media are secured whenever they are not in use | |
| ISM-0240 | ISM-0240 requires that paging, MMS, SMS and messaging apps are not used to communicate sensitive or classified data | |
| ISM-0258 | Annex A 5.10 requires organisations to identify, document and implement rules for acceptable use and handling of information and associat... | |
| ISM-0264 | Annex A 5.10 requires organisations to document and implement rules for acceptable use and handling of information and assets | |
| ISM-0337 | ISM-0337 requires media to only be used with systems authorised to process, store or communicate the media's sensitivity or classification | |
| ISM-0358 | ISM-0358 requires that sanitised SECRET/TOP SECRET EPROM/EEPROM media continues to be handled as classified, affecting how staff may stor... | |
| ISM-0588 | Annex A 5.10 requires documented and implemented rules for acceptable use and handling of information and other assets | |
| ISM-0824 | ISM-0824 advises personnel not to send or receive files via unauthorised online file services to reduce security risk | |
| ISM-0870 | ISM-0870 requires that mobile devices are carried or stored in a secured state when not being actively used, setting an operational secur... | |
| ISM-1078 | Annex A 5.10 requires documented and implemented acceptable use rules for information and associated assets | |
| ISM-1146 | ISM-1146 advises personnel to keep separate work and personal online accounts to reduce cross-contamination and account compromise risks | |
| ISM-1187 | ISM-1187 requires a procedural check during manual export to ensure data does not have unsuitable protective markings | |
| ISM-1359 | ISM-1359 requires an organisation to develop, implement and maintain a removable media usage policy to manage the risks of using removabl... | |
| ISM-1599 | ISM-1599 requires IT equipment to be handled in a manner suitable for its sensitivity or classification | |
| ISM-1644 | ISM-1644 requires that sensitive or classified phone calls and conversations are not conducted in public locations unless precautions are... | |
| ISM-1864 | Annex A 5.10 requires organisations to define and implement acceptable-use rules and handling procedures for information and other assets | |
| ISM-2074 | Annex A 5.10 requires organisations to set and implement acceptable use rules for information and assets | |
| ISM-2075 | ISM-2075 prohibits organisations from using fax machines or online fax services to send or receive fax messages | |
| ISM-2095 | ISM-2095 requires personnel using privately owned devices to access sensitive/protected environments to not grant access to unapproved AI... | |
| ISM-2105 | ISM-2105 requires personnel to limit posting information about their work-related duties on unauthorised online services and to report wh... | |
| ISM-2106 | ISM-2106 requires advising staff not to disclose work skills/experience on unauthorised online services and to report when it occurs | |
sync_altPartially overlaps(5)expand_less | ||
| ISM-0348 | ISM-0348 requires organisations to develop, implement, and maintain media sanitisation processes and supporting procedures | |
| ISM-1083 | Annex A 5.10 requires organisations to document and implement acceptable use rules and handling procedures for information and assets | |
| ISM-1549 | Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets to be documented and implemented | |
| ISM-1551 | ISM-1551 requires an organisation to maintain an IT equipment management policy to govern how IT equipment is handled and controlled | |
| ISM-2104 | ISM-2104 requires personnel not to post security clearance and briefing details on unauthorised online services and to report when this o... | |
handshakeSupports(3)expand_less | ||
| ISM-0661 | ISM-0661 requires user accountability for data transfers across systems | |
| ISM-1865 | ISM-1865 requires personnel to agree to abide by system usage policies before they are granted access to systems and resources | |
| ISM-1868 | ISM-1868 requires that removable media is not used on SECRET and TOP SECRET mobile devices unless ASD approval is obtained beforehand | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ISO 27001 controls in Organisational controls
Annex A 5.7
Threat Intelligence Collection and Analysis
Annex A 5.8
Information security in project management
Annex A 5.9
Inventory management of information and associated assets
Annex A 5.11
Return of Organisation's Assets upon Departure
Annex A 5.12
Information Classification Policy and Practices
Annex A 5.13
Labelling of Information
See all Organisational controls controls, or browse the full ISO 27001 library. You can also track all 93 controls with the free ISO 27001 Annex A checklist.
school
Want to implement this control?
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.