Skip to main content
All measures

Measure · ISO 27001 and other standards

Set and apply acceptable use rules

Define how employees and external users may use information and work assets. Reuse existing rules, explain them to the people concerned and check their application.

Accountable: Policy owners and managersReviewed

Reuse existing records

Keep employee rules in Working securely and information classification and handling in Protecting information, or the corresponding existing policies. Use existing onboarding, approval and operational records for communication and corrections.

What to do

  1. 1

    Confirm the applicable rules for your organisation

    Use Working securely or your existing policy. Define permitted and prohibited use, approved services, personal use and personal devices for the tasks concerned. Describe the usage and security monitoring actually planned. Refer to Protecting information for classification and handling. Have the responsible role approve the adapted version.

  2. 2

    Explain the relevant rules

    Make the current version accessible to the employees and external users concerned. Explain typical work situations, approvals and questions through existing onboarding or instruction processes. Keep the version, audience and communication traceable in those records. Resolve questions about understanding and explain relevant changes again.

  3. 3

    Check handling in an actual workflow

    Follow a usual workflow from creation to sharing or disposal. Check authorised users, storage and protection of copies in line with the original. Use the relevant handling rules, manufacturer instructions and approved disposal routes for devices and media. Address unclear rules and necessary corrections in the existing record, and check the result.

Worked example

Work on a proposal with an external project contributor

An external project contributor needs to work on a confidential customer proposal. They want to use their personal cloud storage.

Approved collaboration
DecisionThe responsible person explains the approved project folder and permitted recipients. The proposal, extracts and exports receive the required protection. Personal cloud storage is not used for this workflow.
EvidenceCurrent rules, actual project access and explanation in the existing onboarding record.

Record the result

  • Current use and handling rules with accessible references and traceable communication to the people concerned.
  • A suitable application example and, where needed, a checked correction in the existing work record.

Common implementation mistakes

Treating acknowledgement as application

An acknowledgement records which version someone has acknowledged. Also check whether the intended route is usable in the actual workflow.

Maintaining the same rules in several places

Refer to the current classification and handling rules. Add only the specific action needed by the relevant audience.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.5.10 · Zulässige Nutzung von Informationen und zugehörigen VermögenswertenGerman guide

    The workflow connects documented use rules with communication and practical handling of information and associated assets. The organisation selects its actual rules and applies them in operation.

  • TISAX · 3.1.3

    VDA ISA 6.0.3 · Partial overlap

    Handling rules and a practical check support the management of supporting assets. Actual transport, storage, repair, loss, return and disposal processes, together with applicable additional protection requirements, still need operational implementation.

    Reference

Templates for your implementation

Related resources

Sources and further reading