In this guide, I will show you exactly how to implement ISO 27001 Annex A 5.10 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy.
I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience conducting hundreds of audits. I will cut through the jargon to show you exactly what changed in the 2022 update and provide you with plain-English advice to get you certified.
Key Takeaways: ISO 27001 Annex A 5.10 Acceptable Use of Information and Other Associated Assets
ISO 27001 Annex A 5.10 requires organizations to define and communicate rules for the acceptable use of information and assets (such as laptops, email, and cloud services). This is a foundational “preventive” control that bridges the gap between technical security and human behavior. The goal is to ensure that every employee, contractor, and third-party user knows exactly what they can and cannot do with company resources, reducing the risk of accidental data leaks, legal liability, and system abuse.
Core requirements for compliance include:
- Formal AUP Implementation: You must have a documented Acceptable Use Policy (AUP) that is approved by management and explicitly acknowledged by all users.
- Full Lifecycle Handling: Acceptable use applies from the moment an asset is assigned until it is returned or destroyed. This includes rules for data classification, secure storage, and correct disposal.
- Cloud & Personal Devices: The rules must extend to assets not owned by the company, such as Cloud Services (SaaS) and BYOD (Bring Your Own Device), if they are used to process company information.
- Monitoring Disclosure: The policy must clearly state what monitoring the organization performs (e.g., email screening or web filtering) to ensure transparency and legal compliance.
- Behavioral Expectations: You must define “prohibited behaviors,” such as installing pirated software, sharing passwords, or visiting high-risk websites (gambling, dark web).
Audit Focus: Auditors will look for “The Acceptance Gap”:
- Acknowledgement Proof: “Show me the signed AUP for your three most recent hires. Did they sign it before they were given their laptops?”
- Staff Knowledge: They may interview a random employee and ask: “Are you allowed to install your own software on this machine? How do you know?”
- Disciplinary Link: Auditors will check if the AUP is linked to your formal Disciplinary Process (A.6.4) to ensure the rules have “teeth.”
AUP Do’s and Don’ts Matrix (Audit Prep):
| Category | Acceptable Use (Do) | Prohibited Use (Don’t) |
| Internet | Work research; light personal banking. | Gambling, adult content, or dark web. |
| Professional comms; light personal use. | Chain letters, harassment, or phishing. | |
| Hardware | Official tasks; charging personal phone. | Mining Crypto or installing pirated tools. |
| Social Media | Professional networking (LinkedIn). | Posting confidential company data or code. |
Table of contents
- What is ISO 27001 Annex A 5.10?
- Watch the ISO 27001 Annex A 5.10 Tutorial
- ISO 27001 Annex A 5.10 Podcast
- How to implement ISO 27001 Annex A 5.10
- Do’s and Don’ts Matrix
- ISO 27001 Acceptable Use Template
- How to comply
- How to pass the ISO 27001 Annex A 5.10 audit
- What will an audit check?
- Top 3 ISO 27001 Annex A 5.10 Mistakes People Make and How to Avoid Them
- Fast Track ISO 27001 Annex A 5.10 Compliance with the ISO 27001 Toolkit
- ISO 27001 Annex A 5.10 FAQ
- Further Reading
- Related ISO 27001 Controls
- ISO 27001 Controls and Attribute Values
What is ISO 27001 Annex A 5.10?
ISO 27001 Annex A 5.10 is about acceptable use which means people need to be informed what is and what is not acceptable to ensure the proper use, handling and protection of organisation assets.
ISO 27001 Annex A 5.10 Acceptable use of information and other associated assets is an ISO 27001 control that requires an organisation to implement rules and procedures for the acceptable use of information and other assets.
ISO 27001 Annex A 5.10 Purpose
The purpose of ISO 27001 Annex A 5.10 is a preventive control that ensures information and other associated assets are appropriately protected, used and handled.
ISO 27001 Annex A 5.10 Definition
The ISO 27001 standard defines ISO 27001 Annex A 5.10 as:
Rules for the acceptable use and procedures for handling information and other associated assets should be identified, documented and implemented.
ISO 27001:2022 Annex A 5.10 Acceptable use of information and other associated assets
Watch the ISO 27001 Annex A 5.10 Tutorial
In the video ISO 27001 Annex A 5.10 Acceptable Use Of Information And Associated Assets Explained show you how to implement it and how to pass the audit.
ISO 27001 Annex A 5.10 Podcast
In this episode: Lead Auditor Stuart Barker and team do a deep dive into the ISO 27001 Annex A 5.10 Acceptable Use Of Information And Other Associated Assets. The podcast explores what it is, why it is important and the path to compliance.
How to implement ISO 27001 Annex A 5.10
To implement ISO 27001 Annex A 5.10 Acceptable Use Of Information And Other Associated Assets you are going to have to ensure that
- Personnel, contractors and third party users are made aware of the information security requirements for protecting and handling assets and information
- People are responsible for their use of company assets
- There is a topic specific policy on acceptable use
- Acceptable use procedures are documented, communicated and in place
What should an acceptable use policy cover?
The Acceptable Use Policy should cover the following topics
- Expected behaviour for information security
- Unacceptable behaviour for information security
- What monitoring the organisation is doing
What acceptable use processes do I need?
You are going to have acceptable use processes for the full information security lifecycle based on its classification and identified risks. What this means is you will consider
- Access restrictions that are based on classification
- Having a record of authorised users of information and systems
- Protecting information that has been copied to the same level as the original
- Following manufacturers specifications when storing information
- Marking storage media for the attention of the recipient
- Processes for disposing information and other assets including deletion methods and authorisation
Acceptable Use and Cloud Services
So what about assets that do not belong to the organisation? Cloud based assets for example. Well you need to identify those as well and record them as applicable and controlled. You are going to ensure there are agreements are in place and those agreements provide the required controls.
Do’s and Don’ts Matrix
| Category | Acceptable Use (Do) | Unacceptable Use (Don’t) |
| Internet | Research, Banking (Lunch break). | Gambling, Adult Content, Dark Web. |
| Business comms, Light personal use. | Chain letters, Harassment, Phishing. | |
| Hardware | Work tasks, Charging personal phone. | Installing pirated software, Mining Crypto. |
| Social Media | LinkedIn (Professional). | Posting confidential company data. |
ISO 27001 Acceptable Use Template
The ISO 27001 acceptable use policy template is pre written and ready to go.
How to comply
To comply with ISO 27001 Annex A 5.10 Acceptable use of information and other associated assets you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:
- Implement a topic specific Acceptable Use Policy
- Implement Acceptable Use Procedures
- Communicate and gain acceptance of the Acceptable Use Policy
How to pass the ISO 27001 Annex A 5.10 audit
To pass an audit of ISO 27001 Annex A 5.10 Acceptable use of information and other associated assets you are going to make sure that you have followed the steps above in how to comply.
What will an audit check?
The audit is going to check a number of areas. Lets go through the main ones
1. That you have an Acceptable Use Policy
What this means is that you need to show that you have an acceptable use policy in place, that it has been approved and signed off.
2. That your Acceptable Use Policy has been communicated and accepted
You need to communicate the Acceptable Use Policy to all staff and get them to accept it. There are many ways to record acceptance of policy from getting email confirmation, an actual signature or using a training tool to distribute and seek understanding and acceptance.
3. That you have covered the entire information lifecycle
Acceptable use covers the entire information lifecycle. It is unlikely that the acceptable use policy will cover everything that is required and it would not make sense for it to do so. Rather you will have a suite of topic specific policies that are complimentary covering things such as logging and monitoring, access control.
Top 3 ISO 27001 Annex A 5.10 Mistakes People Make and How to Avoid Them
The top 3 Mistakes People Make For ISO 27001 Annex A 5.10 are
1. Your haven’t got acceptance from people of the policy
As well as having the policy you need to communicate it and get people to accept it. Often people think is enough just to ‘have’ a policy. It is not.
2. You forgot the bits that were not obvious
Acceptable use is part of many of the policies that you will have as you are communicating to people what is expected of them. Having a complete set of policies that cover the entire information lifecycle is important. Considering access control, information destruction, handling, information transfer and more.
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
Fast Track ISO 27001 Annex A 5.10 Compliance with the ISO 27001 Toolkit
Own Your ISMS, Don’t Rent It
Do it Yourself ISO 27001 with the Ultimate ISO 27001 Toolkit
For ISO 27001 Annex A 5.10 (Acceptable use of information and other associated assets), the requirement is to identify, document, and implement rules for the acceptable use of information and assets. This is about ensuring people know what is and isn’t allowed from email behavioir to social media posting.
While SaaS compliance platforms often try to sell you “automated policy acknowledgments” or complex employee tracking modules, they cannot actually define what “acceptable” looks like for your specific company culture, that is a human governance task. The High Table ISO 27001 Toolkit is the logical choice because it provides the policy framework you need to manage acceptable use once and for all without a recurring subscription fee.
1. Ownership: You Own Your Acceptable Use Policy Forever
SaaS platforms act as a middleman for your compliance evidence. If you define your acceptable use rules and store your employee signatures inside their proprietary system, you are essentially renting your own organizational standards.
- The Toolkit Advantage: You receive the Acceptable Use Policy (AUP) template and Do’s and Don’ts Matrix in fully editable Word/Excel formats. These files are yours forever. You maintain permanent ownership of your standards (such as specific rules for using LinkedIn), ensuring you are always ready for an audit without an ongoing “rental” fee.
2. Simplicity: Governance for Real-World Behavior
Annex A 5.10 is about communicating expectations. You don’t need a complex new software interface to record that your employees shouldn’t mine crypto on company hardware.
- The Toolkit Advantage: Your team already uses tools like email or internal wikis. What they need is the governance layer to prove to an auditor that these expectations are formal, communicated, and accepted by all staff. The Toolkit provides pre-written policies and matrices that formalize your existing culture into an auditor-ready framework, without forcing your team to learn a new software platform just to read a policy.
3. Cost: A One-Off Fee vs. The “Headcount” Tax
Many compliance SaaS platforms charge based on the number of “users” who need to sign the AUP. For a control that must apply to every single person in your company, these monthly costs can scale aggressively.
- The Toolkit Advantage: You pay a single, one-off fee for the entire toolkit. Whether you have 10 employees or 1,000, the cost of your Acceptable Use Documentation remains the same. You save your budget for actual security training or awareness programs rather than an expensive compliance dashboard.
4. Freedom: No Vendor Lock-In for Your Security Strategy
SaaS tools often mandate specific ways to report on and monitor employee behavior. If their system doesn’t match your unique office environment or flexible remote-work model, the tool becomes a bottleneck to efficiency.
- The Toolkit Advantage: The High Table Toolkit is 100% technology-agnostic. You can tailor the Acceptable Use Procedures to match exactly how you operate, whether you have a strict traditional office or a rapid, creative startup culture. You maintain total freedom to evolve your behavior standards without being constrained by the technical limitations of a rented SaaS platform.
Summary: For Annex A 5.10, the auditor wants to see that you have a formal Acceptable Use Policy and proof that it has been communicated to and accepted by all staff. The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.
ISO 27001 Annex A 5.10 FAQ
No. It is a combination of controls ISO 27001:2013 Clause 8.1.3 Acceptable Use of Assets and ISO 27001:2013 Clause 8.2.3 handling of assets.
People cannot be expected to act in a certain way unless we tell them what is expected of them. We want to protect our organisation and our organisation assets and we want to let people know how they can use them. Even if they are what we might think are common sense. So we work out what is acceptable to us and we communicate it. It is part of information security training and awareness and it makes for a safer work environment. It is one of the first lines of information security defence.
ISO 27001 annex A 5.10 covers acceptable use of information and other associated assets.
ISO 27002 clause 5.10 covers acceptable use of information and other associated assets.
Nothing, they are the same thing. ISO 27002 is a standard in its own right and is included as an Annex to the ISO 27001 standard. As such it is often referred to as Annex A but it is a different name for the same thing.
Further Reading
How to Implement ISO 27001 Annex A 5.10: A Practical Guide to Acceptable Use
How to Audit ISO 27001 Annex A 5.10: An Auditor’s Step-by-Step Guide
Your 10-Point Checklist for Mastering ISO 27001 Annex A 5.10: Acceptable Use
Pass Your ISO 27001 Audit: A 10-Point Checklist for Annex A 5.10
A Tech Startup’s Practical Guide to ISO 27001 Annex A 5.10: Acceptable Use
A Practical Guide for SMEs to ISO 27001 Annex A 5.10: Acceptable Use of Information and Assets
ISO 27001 Acceptable Use Policy Beginner’s Guide
ISO 27001 Asset Management Policy Template
Related ISO 27001 Controls
ISO 27001 Annex A 5.9 Inventory Of Information And Other Associated Assets
ISO 27001 Controls and Attribute Values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Confidentiality | Protect | Asset management | Protection |
| Integrity | ||||
| Availability |
About the author
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.
Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.
As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.
His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.
