Skip to main content
All measures

Measure · ISO 27001

Check usage rights and licences

Compare permitted use with your actual software and content inventory. Reuse existing procurement and licence records.

Accountable: Procurement or licence owners with IT and the people using the workReviewed

Reuse existing records

Use your existing software, asset or procurement record. Add missing licence details there rather than maintaining a second rights or installation list.

What to do

  1. 1

    Clarify rights before use

    For software, text, images and other works, check the trusted source, permitted use and applicable licence conditions. Include your own work and results created by employees or suppliers. Clarify who may acquire rights and approve use. Existing information protection and procurement rules remain authoritative.

  2. 2

    Connect evidence and actual use

    Keep the contract or licence evidence accessible from the existing record. Note relevant limits such as user count, permitted environment, redistribution or required notices. Compare actual use against them. For open source, examine the specific licence and your use, modifications or distribution; a separate open-source register is not automatically necessary.

  3. 3

    Close changes and exceptions

    Review rights when extending use, publishing, transferring or retiring the work. Correct unauthorised use and record the decision, owner and result in the existing record. Use its version history or dated material changes and arrange a suitable regular review.

Worked example

An operational example

Fictional example: An application allows 20 active users. Its existing software record links the licence and account inventory.

Usage limit
DecisionThe comparison identifies two unnecessary accounts. Administration removes them and checks the new active total.
EvidenceLicence reference, actual count and dated completion in the existing software record.

Record the result

  • Accessible rights or licence evidence and relevant usage limits.
  • Actual use checked and exceptions handled traceably.

Common implementation mistakes

Treating a receipt as unlimited permission

The specific conditions determine permitted use. A receipt alone may not explain those limits.

Related requirement

The references below show which requirements the measure contributes to.

View controls and standards
  • A.5.32 · Geistiges EigentumGerman guide

    The workflow connects own and third-party rights, controlled acquisition, evidence, actual use and changes. Existing access and information protection measures protect confidential proprietary work.

Templates for your implementation

Sources and further reading