ISO 27001 Annex A 5.32 Intellectual property rights protection

1. 01

   The IT manager should create a clear policy on intellectual property protection.

   This policy must be communicated to all staff, outlining what intellectual property is and how it should be handled to comply with legal requirements. Refer to ISO 27002:2022 guidance on defining these policies.

2. 02

   Procurement personnel must ensure that all purchased software comes from reputable, authorised sources.

   This includes verifying the legitimacy of licences to avoid using pirated software, which can lead to legal penalties.

3. 03

   The legal team should maintain records of all software licences and intellectual material ownership.

   This involves keeping an up-to-date inventory of all such assets to demonstrate compliance and ownership if questioned.

4. 04

   HR and management should conduct regular training sessions with staff on appropriate software use and intellectual property laws.

   These sessions should highlight the importance of compliance and the risks of infringement.

5. 05

   IT staff need to conduct periodic audits of software and installed applications to verify compliance.

   This includes ensuring that only authorised software is used and all licensing terms and conditions are met, especially with regards to user access limits.

1. Check 1 of 5What an auditor asks for

   Ask for

   The intellectual property protection policy document.

   Look at

   Whether the policy clearly defines and communicates protection measures and responsibilities.

   Good evidence

   A comprehensive policy that is well-communicated to all staff.

2. Check 2 of 5What an auditor asks for

   Ask for

   A list of all purchased software and their source documentation.

   Look at

   The sources from which software was acquired and evidence of proper licensing.

   Good evidence

   All software being purchased from reputable and approved vendors, with valid licences.

3. Check 3 of 5What an auditor asks for

   Ask for

   Records demonstrating proof and evidence of intellectual property ownership.

   Look at

   How these records align with current software and information usage.

   Good evidence

   Up-to-date and complete documentation for all registered intellectual property assets.

4. Check 4 of 5What an auditor asks for

   Ask for

   Training materials and attendance records regarding intellectual property rights.

   Look at

   The frequency and coverage of the training.

   Good evidence

   Regular, comprehensive sessions attended by relevant staff members.

5. Check 5 of 5What an auditor asks for

   Ask for

   Results from periodic software audits.

   Look at

   The compliance with licence terms, especially regarding user access and software installations.

   Good evidence

   Documented audit findings with actions taken on any non-compliances.

No mappings to other frameworks are recorded for this control yet.