ISO 27001 Annex A 5.14 Information transfer policies and procedures

This control is equivalent to ISM-0663.

Annex A 5.14 requires rules, procedures, or agreements to govern secure information transfer internally and with external parties. ISM-0663 directly requires that data transfer processes and supporting procedures are developed, implemented, and maintained. Both controls focus on establishing and maintaining formalised information transfer procedures across transfer methods, with very similar intent and scope.

This control is broader than ISM-0231.

ISM-0231 requires telephone systems that use cryptographic equipment to support different levels of conversation to visually indicate which kind of connection has been made. This gives users the cue they need to follow information transfer rules for voice communications, such as not discussing sensitive information over an unsecured connection, which Annex A 5.14 requires for all transfer facilities. Annex A 5.14 covers rules, procedures and agreements for every type of transfer, while ISM-0231 is a narrow technical measure for secure telephony.

This control is broader than ISM-0240.

Annex A 5.14 requires organisations to establish rules and procedures that control how information is transferred, including selecting appropriate transfer channels. ISM-0240 supports this by prohibiting use of SMS/MMS/paging and messaging apps for communicating sensitive or classified data, effectively defining an information transfer rule for certain channels. ISM-0240 is limited to specific messaging services and sensitive/classified data, while Annex A 5.14 applies across all information types and transfer facilities.

This control is broader than ISM-0347.

Annex A 5.14 requires controlled information transfer rules and procedures for all transfer facilities, including manual transfers. ISM-0347 supports this by prescribing a specific secure method for manual cross-domain transfer (write-once media unless read-only can be ensured), which operationalises part of a transfer procedure. ISM-0347 is a technical constraint for a particular high-risk transfer scenario, whereas Annex A 5.14 is broader and requires governance across all transfer types.

This control is broader than ISM-0467.

ISM-0467 requires HACE to be used to protect SECRET and TOP SECRET data communicated over insecure networks, public infrastructure, or outside secure areas. Annex A 5.14 requires organisations to implement information transfer rules and procedures, where HACE can be mandated as the secure transfer method for classified data. While Annex A 5.14 is broader and process-focused, ISM-0467 is a specific technical control for high-classification communications in particular risk conditions.

This control is broader than ISM-0490.

ISM-0490 requires organisations to prevent the use of S/MIME versions earlier than 3.0 for secure email connections. Annex A 5.14 requires organisations to establish and implement rules and procedures for information transfer, which includes selecting appropriate secure email transfer and protection mechanisms. ISM-0490 is a specific technical standard for one transfer mechanism (S/MIME), whereas Annex A 5.14 is broader and covers all transfer methods and governance arrangements.

This control is broader than ISM-0571.

ISM-0571 requires emails to be sent and received via an organisation's centralised email gateways using authenticated and encrypted channels. ISO/IEC 27001:2022 Annex A 5.14 requires rules and procedures for information transfer using any transfer facilities, which includes (but is not limited to) email transfer controls like secure gateways and TLS. ISM-0571 is a specific implementation pattern for secure email transfer, whereas Annex A 5.14 covers broader transfer methods, partners, and governance arrangements beyond email.

This control is broader than ISM-0574.

ISM-0574 requires SPF records to specify the authorised email servers (or the lack of any) for all of an organisation's domains and subdomains. This lets receiving parties authenticate email sent in the organisation's name, a specific control for securing electronic messaging, which is one of the transfer facilities Annex A 5.14 requires to be governed by transfer rules and procedures. Annex A 5.14 covers every type of information transfer, while ISM-0574 addresses only sender authorisation for email domains.

This control is broader than ISM-0626.

ISM-0626 mandates the use of CDSs to manage cross-domain connectivity between SECRET or TOP SECRET networks and other domains. ISO/IEC 27001:2022 Annex A 5.14 requires documented procedures for information transfer, which CDSs technically enforce (filtering, inspection, controlled release). Annex A 5.14 focuses on procedural requirements while ISM-0626 provides a specific technical solution for high-classification cross-domain transfers.

This control is broader than ISM-0643.

ISM-0643 requires evaluated diodes to control data flow in unidirectional gateways between internal networks and public network infrastructure. ISO/IEC 27001:2022 Annex A 5.14 requires information transfer rules and procedures for transfer facilities, and a diode-enforced one-way gateway is a technical enforcement mechanism that can underpin those transfer rules (e.g. only outbound telemetry/log export). Annex A 5.14 is policy/procedure focused across many transfer methods, while ISM-0643 is a specific boundary technology control.

This control is broader than ISM-0649.

ISM-0649 requires that files imported or exported via gateways or cross-domain solutions (CDSs) are filtered so only allowed file types can pass. Annex A 5.14 requires organisations to define and implement policies and procedures for information transfer, which can include technical controls (such as file-type allowlisting) for particular transfer channels like gateways. ISM-0649 is a specific technical enforcement mechanism within the broader governance and procedural scope of Annex A 5.14.

This control is broader than ISM-0660.

ISM-0660 requires organisations to fully verify data transfer logs for SECRET and TOP SECRET systems at least monthly to ensure authorised and appropriate information movement. This supports Annex A 5.14 because information transfer policies and procedures should define approved transfer methods and associated monitoring/record-keeping that produce the logs ISM-0660 then verifies. Annex A 5.14 is broader (rules, agreements and procedures for all transfer types), while ISM-0660 is a specific assurance activity targeted at classified-system transfer logs and a defined verification frequency.

This control is broader than ISM-0675.

ISM-0675 requires that data authorised for export from SECRET and TOP SECRET systems is digitally signed by a trustworthy source to preserve authenticity and integrity during export. Annex A 5.14 requires organisations to define and implement rules and procedures for information transfer, which can include integrity and authenticity requirements such as digital signatures for sensitive transfers. ISM-0675 is a specific, high-assurance implementation for classified system exports, whereas Annex A 5.14 covers all transfer mechanisms, parties and transfer rules beyond signing.

This control is broader than ISM-0677.

ISM-0677 requires that files crossing system boundaries via gateways or CDSs have their digital signatures or cryptographic checksums validated to assure integrity. Annex A 5.14 requires organisations to define and implement rules and procedures for information transfer, within which signature/checksum validation is a concrete integrity control for file transfers. Annex A 5.14 is broader (policy/procedural coverage across transfer methods), while ISM-0677 is a specific technical validation requirement at transfer boundaries.

This control is broader than ISM-0861.

ISM-0861 requires DKIM signing on all emails sent from an organisation's domains and subdomains, so recipients can verify that messages genuinely originated from the organisation and were not altered in transit. This is a specific technical measure for the secure transfer of information by electronic messaging, which Annex A 5.14 requires the organisation to govern through transfer rules, procedures or agreements. Annex A 5.14 is much broader, covering all transfer facilities and parties, while ISM-0861 addresses only sender authentication and integrity for outbound email.

This control is broader than ISM-0947.

ISM-0947 requires sanitising rewritable media after each manual transfer between different security domains to prevent information leakage via residual data. Annex A 5.14 requires information transfer rules and procedures for transfer mechanisms, and ISM-0947 provides a concrete procedural safeguard that can be embedded into those transfer procedures. Annex A 5.14 is broader and policy/procedure-oriented, while ISM-0947 is a specific technical/operational control applied during manual cross-domain transfers.

This control is broader than ISM-1024.

ISM-1024 requires notifications of undeliverable emails to be sent only to senders that can be verified via SPF or other trusted means, preventing bounce messages from going to spoofed addresses. This is a specific email handling rule that stops the organisation's mail system misdirecting message content to third parties, which falls within the electronic messaging rules that Annex A 5.14 requires for transfer facilities. Annex A 5.14 covers all information transfer rules and agreements, while ISM-1024 addresses only the handling of non-delivery notifications.

This control is broader than ISM-1026.

ISM-1026 requires DKIM signatures on incoming emails to be verified, confirming that messages came from an authorised domain and were not altered in transit. This is a specific integrity and sender authentication measure for electronic messaging, one of the transfer facilities that Annex A 5.14 requires to be governed by information transfer rules and procedures. Annex A 5.14 is broader, covering all transfer types and agreements with other parties, while ISM-1026 addresses only verification of inbound email signatures.

This control is broader than ISM-1178.

ISM-1178 requires that network documentation shared with third parties (including in public tenders) is limited to only what is necessary to perform contractual services. Annex A 5.14 requires the organisation to define and apply rules, procedures or agreements for transferring information internally and to other parties, which includes setting conditions and content for what is shared. ISM-1178 is a specific application of information transfer governance focused on minimising network detail exposure to external parties, whereas Annex A 5.14 is broader across all transfer types and information.

This control is broader than ISM-1277.

ISM-1277 requires that data communicated between database servers and web servers is encrypted to protect it in transit. Annex A 5.14 requires the organisation to define and implement rules/procedures/agreements for information transfer across transfer facilities, which would typically include mandating encryption for sensitive internal service-to-service traffic such as web-to-database connections. ISM-1277 is a specific technical requirement for one transfer path, while Annex A 5.14 is broader governance over many transfer methods and contexts.

This control is broader than ISM-1284.

ISM-1284 requires that files imported or exported via gateways or Cross Domain Solutions (CDSs) undergo content validation to prevent unsafe or non-compliant content crossing security boundaries. ISO/IEC 27001:2022 Annex A 5.14 requires information transfer rules and procedures for all transfer facilities, which can include gateways and the need for checks on transferred content. ISM-1284 is a specific technical/operational control within the broader governance requirement of Annex A 5.14 (which also covers agreements, responsibilities, and multiple transfer methods beyond file gateways).

This control is broader than ISM-1502.

ISM-1502 requires the email gateway to block emails arriving via an external connection that use an internal domain or subdomain as the source address, preventing spoofed messages from impersonating internal senders. This is a specific technical safeguard for the security of information transfer by electronic messaging, which Annex A 5.14 requires the organisation to govern through transfer rules and procedures. Annex A 5.14 covers all transfer facilities and parties, whereas ISM-1502 addresses only inbound email sender spoofing at the gateway.

This control is broader than ISM-1535.

ISM-1535 requires organisations to develop, implement, and maintain processes and procedures to prevent AUSTEO, AGAO, and REL data from being exported to unsuitable foreign systems. Annex A 5.14 requires information transfer rules, procedures, or agreements for all types of transfer facilities within and between organisations and other parties. ISM-1535 is a more specific, higher-sensitivity constraint within the broader transfer-governance expectation of Annex A 5.14, focusing on preventing the foreign export of particular Australian Government data types.

This control is broader than ISM-1540.

ISM-1540 requires DMARC records to be published for an organisation's domains and subdomains with a policy that rejects emails failing DMARC checks, preventing others from sending email that impersonates the organisation. This is a specific technical control for the security of information transfer by electronic messaging, which Annex A 5.14 requires the organisation to govern through transfer rules, procedures or agreements. Annex A 5.14 covers all transfer facilities and parties, whereas ISM-1540 addresses only sender authentication policy for email domains.

This control is broader than ISM-1589.

ISM-1589 requires organisations to enable MTA-STS to prevent unencrypted SMTP transport between mail transfer agents. Annex A 5.14 requires information transfer rules and procedures across transfer methods and parties, under which secure email transport requirements (including mandating TLS and enforcing it via MTA-STS) would be defined. Annex A 5.14 is broader and governance-focused, while ISM-1589 is a specific technical implementation for email in transit.

This control is broader than ISM-1778.

ISM-1778 requires that, when data is manually imported to systems, any data failing security checks is quarantined until it is reviewed and either approved or not approved for release. This is a specific procedure for one transfer facility, manual data import, of the kind Annex A 5.14 requires the organisation to govern with information transfer rules and procedures. Annex A 5.14 covers all types of transfer within and between organisations, while ISM-1778 addresses only the handling of imported data that fails security checks.

This control is broader than ISM-1799.

ISM-1799 requires incoming emails that fail DMARC checks to be rejected, blocking messages that spoof a sender's domain. This is a specific sender authentication control for electronic messaging, which is one of the transfer facilities that Annex A 5.14 requires the organisation to govern with rules and procedures. Annex A 5.14 covers all forms of information transfer and related agreements with other parties, while ISM-1799 addresses only inbound email authentication enforcement.

This control is broader than ISM-2098.

ISM-2098 requires mobile devices to be configured to prevent data transfers over USB connections. ISO/IEC 27001:2022 Annex A 5.14 requires information transfer rules and procedures for all transfer facilities, which can include controls over physical interfaces such as USB when they are used as a transfer channel. ISM-2098 is one concrete, device-level control that implements a restriction within the wider policy or procedure framework of Annex A 5.14.

This control partially overlaps ISM-0661.

ISM-0661 requires users to be accountable for data transfers they perform to and from systems. Annex A 5.14 involves establishing information transfer rules, procedures, or agreements that cover transfer methods and channels. These overlap where transfer procedures such as approved methods and logging provide the basis for attributing transfers to individuals, thus supporting accountability. However, Annex A 5.14 mainly focuses on governing transfer mechanisms, whereas ISM-0661 is specifically about user accountability.

This control partially overlaps ISM-1574.

ISM-1574 requires contractual arrangements with service providers to document portable data storage arrangements that support backups, service migration and decommissioning without data loss. Annex A 5.14 requires information transfer rules/procedures/agreements for information transfers within the organisation and between the organisation and other parties, which includes supplier transfer arrangements. Annex A 5.14 is broader across all transfer types and channels, while ISM-1574 is specifically about data portability and lifecycle outcomes (backup, migration, exit) being contractually defined.

This control partially overlaps ISM-1779.

ISM-1779 requires quarantining data that fails security checks during manual export until it is reviewed and approved for release. Annex A 5.14 requires information transfer rules and procedures for all transfer methods, which would typically include defined approval gates and handling of failed checks for outbound transfers. Annex A 5.14 is broader, covering all transfer facilities and agreements, whereas ISM-1779 is more specific on the quarantine-and-review mechanism for manual exports.

This control partially overlaps ISM-1866.

ISM-1866 requires controls that prevent classified data being stored on privately-owned devices when users access sensitive systems/data. ISO/IEC 27001:2022 Annex A 5.14 requires information transfer rules and procedures for transfers within the organisation and with external parties, which can include prohibitions and technical controls around transferring data onto unmanaged/personal devices. Annex A 5.14 is primarily about governing transfer channels, while ISM-1866 is about endpoint storage outcomes.

This control depends on ISM-2097.

ISM-2097 requires always on VPN on mobile devices to secure communications between the device and organisational services. This supports Annex A 5.14 by strengthening the security of information transfers through an approved, protected transfer path (encrypted tunnel) rather than unmanaged networks. Annex A 5.14 is broader because it requires formalised transfer rules and procedures for all transfer methods, not a specific VPN configuration on mobiles.