ISO 27001 Annex A 5.14 Information Transfer Explained

ISO 27001 Information Transfer

ISO 27001 Annex A 5.14 Information Transfer is an ISO 27001 control that requires an organisation to have rules, procedures or agreements in place for all types of transfer within the organisation and with third parties.

It is about information transfer which means you need to make sure that information is transferred safely and securely.

Key Takeaways

ISO 27001 Annex A 5.14 requires organisations to establish rules, procedures, and agreements for all types of information transfer facilities. Whether you are sending a digital file via email, shipping a physical hard drive, or having a sensitive conversation in a meeting room, the data must remain secure in transit. This control is designed to prevent the unauthorised disclosure, modification, or loss of information as it moves between internal teams or to external third parties.

Purpose

The purpose of ISO 27001 Annex A 5.14 is to ensure that you maintain the security of information transferred within an organisation and with any external interested party.

Definition

The ISO 27001 standard defines ISO 27001 Annex A 5.14 as:

Information transfer rules, procedures, or agreements should be in place for all types of transfer facilities within the organisation and between the organisation and other parties.

ISO 27001:2022 Annex A 5.14 Information Transfer

Explanation

ISO 27001 Annex A 5.14 Information Transfer is a security control that requires organisations to establish rules, procedures, and agreements for all types of transfer facilities. Enforcing secure transit prevents unauthorised disclosure, yielding the business benefit of maintaining client trust and compliance across all borders.

Requirement

• Rules for 3 Transfer Methods: You must address three specific modes of transfer:
  1. Electronic: Email, SFTP, Cloud Sharing, and Messaging apps.
  2. Physical: Paper documents, USB drives, and removable storage media.
  3. Verbal: Phone calls, video conferences, and in-person discussions.
• Proportionate Protection: Controls must match the data’s classification (from Annex A 5.12). For example, “Public” data can go via standard email, but “Confidential” data requires encryption and restricted access links.
• Traceability & Non-Repudiation: For sensitive transfers, you must be able to prove who sent the information, who received it, and that it wasn’t modified in transit. This often involves logs and delivery receipts.
• Malware Prevention: Electronic transfer systems must have active scanning to detect and block malicious attachments.
• Physical Security in Transit: When moving physical media, you must use reliable couriers, appropriate packaging (to prevent tampering), and maintain a clear chain of custody.

Audit Focus

1. Policy vs. Reality: “Your policy forbids using personal WhatsApp for business. How do you monitor this, and have you ever had to enforce your disciplinary process for a breach?”
2. Encryption Proof: “Show me an example of a ‘Confidential’ file sent to a client last month. Can you prove it was encrypted and sent via an approved method?”
3. Physical Media Logs: “If you send a backup tape or hard drive to off-site storage, show me the log entry and the courier receipt.”

FREE Training Video

Implementation Guide

The prerequisite for the this annex a control is having an information classification scheme in place. We covered information classification in – ISO 27001 Annex A 5.12 Classification of Information Beginner’s Guide

Once you have your classification scheme in place you are going to then implement rules, procedures and agreements to protect information in transit based on its classification and the classification scheme you have established.

You are going to have to

• Establish and communicate a topic specific policy on information transfer
• Implement rules, procedures and/ or agreements for information transfer to protect information in transit
• Cover information and other associated assets in all formats

Remembering that information transfer can be done in many ways including through electronic transfer, physical storage media transfer and even verbal transfer.

Let us explore what the standard is expecting for each transfer method.

All information transfers

For all information transfer

• Implement controls proportionate to the information classification and business risk to protect against destruction, interception, unauthorised access, copying, modification – basically to protect the confidentiality, integrity and availability of the information.
• Put in place the ability to ensure traceability and the fancy word of non repudiation which includes a chain of custody wile in transit. Do you know who had it and what they did with it and can you prove it if you need to?
• The standard loves having owners so you will have the usual suspects of data owners, risk owners and all the roles and responsibilities defined by the management system. Those involved in the transfer of information should really be defined along with their contact details.
• Put in place who does what if there is a breach or an incident and who is going to be liable
• Obviously as we covered in ISO 27001 Annex A 5.13 Labelling Of Information Beginner’s Guide – you are going to have information labelling.
• In the top trumps of requirements the law always wins so clearly you will look at the legal register you have completed and look at relevant laws, regulations and contractual requirements that apply to you and follow them for information transfer.
• Set out your guidelines on storage and deletion of business records, and messages.
• Ensure the availability of the transfer service.

Electronic Transfers

There are some extra things you will have to do for electronic transfers. Nothing unusual but they are

• Detect and protect against malware and viruses
• If you use attachments and they include sensitive information – protect them.
• When you send something to someone make sure it is the correct someone.
• If you simply must use public means like instant messaging, get approval first. And then put in place some stronger measures and stricter authentication.
• Tell people not to message or SMS critical information. You can tell them. They won’t listen. And no one can check as they are private. Still, be sure to tell them eh?

Fax Machines

I mean WTAF but still, people use them apparently. The standard is all nice and vague about advising people of the problems of using them. It omits the fact the main problem is this is not 1987 but still tell people about the problems. Apparently. The actual reality is if you do use them then you are controlling them through risk management and compensating controls.

Physical Storage Media Transfers

So we are going to move some physical media or paper about the place? If you must you must. But if you do then

• Someone needs to be assigned responsibility for notifying it will happen, making it happen and getting a reciept that it happened. Nice work if you can get it.
• Send it to the right person, in the right way, eh? I mean, come on.
• Nothing stops a thief like a package so packaging is covered. Packaging has its place. Think amazon. Package that bad boy before you send it.
• I am not a fan of Evri per se, but then this is not my call and other couriers are available so you need to have an agreed list. The standard says of reliable couriers. Which is hilarious. Just have a list of the least shit.
• It wants you to have courier identification standards. Which is vague AF. Pick mainstreams ones and you will be ok. Or you could try asking – ‘are you a courier’ before handing over priceless data and if the answer is ‘er, yes’ then I think you are golden.
• Log everything!

Verbal Transfers

Oh my sweet god, so we are in the realms of thought police. I wish you god speed with this one but lets look at what the standard believes people will do.

• No confidential chit chats in public places!
• No answer machine messages with that confidential data on. ‘Hi, this is Stuart, I am not available right now so please leave your confidential information after the beep……’
• Screen people to the appropriate level to listen to the conversation – Bwhhahhh hhahhha hhhaaa
• Have room controls in place like sound proofing – which is a little to 50 shades of grey for my liking. Please come into this sound proof room so I may whisper confidential information at you.
• Begin any sensitive conversation with a disclaimer. Of course. Obvious really. Give it a try. People will love you for it.

The 3 transfer methods covered in ISO 27001

The 3 transfer methods of ISO 27001 that are now explicitly covered are

• Electronic
• Physical
• Verbal

How to implement it

1. Identify and Document all Transfer Facilities

Action: Conduct a thorough discovery exercise to map every method used to move data. Result: A comprehensive Asset Register that includes electronic channels, physical courier routes, and verbal communication paths.

• Identify automated API feeds and Managed File Transfer (MFT) systems.
• Document physical media transport protocols for hard drives or tapes.
• Include cloud-based sharing platforms like SharePoint or Dropbox.

2. Establish a Formal Information Transfer Policy

Action: Draft and approve a topic-specific policy for information transfer. Result: Clear organisational rules that define acceptable and prohibited transfer methods for all staff.

• Define classification levels for data allowed for external transfer.
• Set mandatory security requirements for different types of information.
• Establish clear disciplinary consequences for using unauthorised “Shadow IT” channels.

3. Provision Secure Communication Channels

Action: Implement technical safeguards for data in transit. Result: Technical assurance that data remains confidential and untampered during movement.

• Enforce TLS 1.2 or higher for all web-based transfers.
• Utilise AES-256 encryption for file-level protection.
• Deploy Virtual Private Networks (VPNs) for site-to-site data synchronisation.

4. Formalise Information Transfer Agreements (ITAs)

Action: Execute legally binding agreements with third parties. Result: Enforceable security obligations that protect your data once it leaves your perimeter.

• Include specific clauses for incident notification and data breach reporting.
• Define the technical standards the recipient must maintain.
• Specify the required protocols for data return or destruction upon contract termination.
• Ensure ITAs are signed by both parties before any sensitive data movement occurs.

5. Implement Strict IAM Roles and Access Controls

Action: Apply the principle of least privilege to transfer systems. Result: Restricted access ensuring only authorised personnel can initiate or receive sensitive transfers.

• Configure Identity and Access Management (IAM) roles specifically for transfer administrators.
• Enforce Multi-Factor Authentication (MFA) for all external transfer portals.
• Regularly review and revoke access for staff who no longer require transfer capabilities.

6. Secure Physical Media and Transit Routes

Action: Apply physical security controls to tangible data assets. Result: Protection against theft, loss, or tampering during the physical courier process.

• Use tamper-evident packaging and serialised security seals.
• Mandate the use of vetted, reputable couriers with GPS tracking and chain of custody logs.
• Ensure all physical media is encrypted at rest before it leaves the secure facility.

7. Enforce Data Integrity Verification

Action: Deploy hashing and digital signature protocols. Result: Mathematical proof that the information received is identical to the information sent.

• Generate SHA-256 checksums for large file transfers.
• Utilise digital certificates to authenticate the identity of the sender and receiver.
• Implement automated alerts for any transfer that fails integrity validation.
• Maintain a log of all successful and failed integrity checks for audit evidence.

8. Monitor and Log all Transfer Activities

Action: Enable comprehensive auditing on all transfer facilities. Result: A forensic trail of “who, what, when, and where” for every piece of moved data.

• Centralise logs in a Secure Information and Event Management (SIEM) system.
• Monitor for unusual patterns, such as mass data exfiltration or unauthorised destination IPs.
• Retain logs in accordance with your statutory and regulatory requirements.

9. Deliver Staff Awareness Training

Action: Train employees on secure transfer procedures. Result: A reduction in human error and a “human firewall” against social engineering or accidental leaks.

• Provide specific guidance on the risks of verbal data disclosure in public spaces.
• Train staff on how to use approved encrypted file-sharing tools correctly.
• Educate employees on how to spot phishing attempts targeting transfer credentials.

10. Conduct Regular Compliance Audits

Action: Perform internal reviews of transfer controls and agreements. Result: Continuous improvement and the identification of control gaps before they lead to a breach.

• Review a sample of Information Transfer Agreements annually for accuracy.
• Perform penetration testing on external-facing transfer APIs and portals.
• Verify that the Record of Processing Activities (ROPA) accurately reflects current transfer flows.

Implementation Checklist

Checklist Item	What to Implement	Example Evidence
1. Topic-Specific Policy	Establish formal rules for all information transfer types including electronic, physical, and verbal.	An approved Information Transfer Policy.
2. Transfer Agreements	Formalise security requirements with third parties before any sensitive data movement occurs.	Signed Information Transfer Agreements (ITAs) or specific clauses in supplier contracts.
3. Transit Encryption	Mandate technical safeguards for all data moving across public or internal networks.	Configuration logs showing mandatory TLS 1.3 or AES-256 file-level encryption.
4. Access Management	Restrict the ability to use transfer facilities to authorised personnel only based on business need.	Role-based access controls and MFA enforced on Managed File Transfer (MFT) portals.
5. Physical Media Controls	Secure the transport of tangible data assets such as hard drives, tapes, or printed documents.	Use of vetted couriers, tamper-evident packaging, and encryption of media at rest.
6. Verbal Transfer Rules	Protect sensitive information discussed via phone, video call, or in person.	Staff training records covering non-disclosure and the use of secure meeting rooms.
7. Integrity Verification	Implement controls to detect if data has been tampered with or corrupted during the transfer.	Automated hashing (e.g. SHA-256) or digital signatures applied to transfer batches.
8. Audit Logging	Maintain a detailed trail of all information transfer activities for forensic and compliance review.	Logs detailing sender, recipient, date, and time integrated into a central SIEM.
9. Facility Inventory	Identify and document every gateway, API, and physical route used for data movement.	A comprehensive list of transfer facilities within the Asset Register.
10. Awareness Training	Educate staff on the risks of misdirected information and the correct use of secure tools.	Annual security awareness certificates focusing on “Safe Sharing” and phishing risks.

Approved Transfer Methods Table

Data Classification	Email (Standard)	Email (Encrypted)	File Transfer (e.g. SFTP)	Cloud Share (e.g. OneDrive)	USB Drive	ISO 27001:2022 Controls
Public	✅ Allowed	✅ Allowed	✅ Allowed	✅ Allowed	✅ Allowed	Annex A 5.12, 5.14
Internal	✅ Allowed	✅ Allowed	✅ Allowed	✅ Allowed	⚠️ Encrypted Only	Annex A 5.12, 5.14, 8.24
Confidential	❌ Forbidden	✅ Allowed	✅ Allowed	✅ Allowed (Restricted Link)	⚠️ Encrypted Only	Annex A 5.12, 5.14, 8.24
Secret	❌ Forbidden	❌ Forbidden	✅ VPN/SFTP Only	❌ Forbidden	❌ Forbidden	Annex A 5.12, 5.14, 8.24

ISO 27001 Templates

If you want to write these yourself I totally commend you. And pity you in equal measure. You could save months of effort with these templates that take 25 years of experience and distill it in a pack of prewritten best practice awesomeness.

How to comply

To comply with ISO 27001 Annex A 5.14 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to

• Get yourself a topic specific policy and communicate it
• Implement your classification scheme
• Define and Implement your procedures, rules and agreements for transfers
• Communicate and make sure people follow said procedures, rules and agreements

How to audit ISO 27001 Annex A 5.14

1. Verify the existence and approval of a topic-specific Information Transfer Policy

Action: Request the latest version of the Information Transfer Policy and check for executive sign-off. Result: Ensure the organisation has established formalised rules that govern all internal and external data movements to prevent unauthorised disclosure.

• Check that the policy covers electronic, physical, and verbal communication channels.
• Confirm the policy defines prohibited transfer methods such as unauthorised cloud storage or personal email.
• Validate that the policy is reviewed at least annually or upon significant changes to the technical environment.

2. Inspect the Asset Register for identified transfer facilities

Action: Cross-reference the Asset Register with the technical landscape to identify all transfer points. Result: Confirm that every electronic gateway, physical courier route, and automated API feed is documented and risk-assessed.

• Verify that Managed File Transfer (MFT) systems and SFTP servers are listed.
• Ensure that physical media transport assets are accounted for in the register.
• Check for the inclusion of third-party cloud sharing platforms used for business operations.

3. Examine Information Transfer Agreements (ITAs) and NDAs

Action: Sample a selection of third-party contracts and Non-Disclosure Agreements. Result: Validate that legal and technical security requirements are baked into agreements to ensure the protection of data once it leaves the organisational perimeter.

• Check for specific clauses regarding incident notification and data breach reporting.
• Confirm the agreements specify the required encryption standards for the recipient.
• Validate that procedures for data return or destruction upon contract termination are clearly defined.

4. Analyse cryptographic configurations for electronic transfers

Action: Perform a technical review of the encryption protocols used for data in transit. Result: Ensure that information is protected using modern standards like TLS 1.3 or AES-256 and that legacy, insecure protocols are disabled.

• Inspect SSL/TLS certificates to ensure they are valid and issued by a trusted authority.
• Verify that Multi-Factor Authentication (MFA) is enforced for all external-facing transfer portals.
• Check for the use of end-to-end encryption for sensitive file transfers between departments.

5. Audit the chain of custody for physical media transfers

Action: Review logs and receipts for the physical transport of hard drives or tapes. Result: Verify that physical transport utilizes tamper-evident packaging and vetted personnel to prevent loss or interception.

• Check for signed handover records that document the movement of media from sender to courier.
• Confirm that all physical media is encrypted at rest before being dispatched.
• Verify the use of reputable couriers with GPS tracking capabilities for high-sensitivity assets.

6. Review Identity and Access Management (IAM) roles for transfer systems

Action: Sample the user access list for Managed File Transfer (MFT) and administrative consoles. Result: Confirm that access follows the principle of least privilege and that administrative rights are strictly controlled.

• Check for the presence of MFA for all users with administrative access to transfer facilities.
• Verify that access is revoked promptly for leavers or those changing roles.
• Ensure that generic or shared accounts are not used to initiate data transfers.

7. Test data integrity verification protocols

Action: Request evidence of integrity checks performed during or after transfers. Result: Provide mathematical proof that the organisation utilises checksums, digital signatures, or hashing algorithms to detect data tampering.

• Review logs for SHA-256 or similar hash verifications on large file batches.
• Check that digital signatures are used to authenticate the sender for sensitive communications.
• Verify that automated alerts are triggered if a transfer fails an integrity check.

8. Evaluate monitoring logs and SIEM alerts for transfer facilities

Action: Review the audit trails and security alerts generated by transfer gateways. Result: Determine if unauthorised data exfiltration or misdirected transfers are detected and escalated in real-time.

• Check for logs detailing the date, time, sender, recipient, and volume of data moved.
• Verify that transfer logs are integrated into a central SIEM for correlation.
• Confirm that logs are protected from unauthorised modification or deletion.

9. Validate staff awareness and training for verbal transfer protocols

Action: Review training records and interview staff regarding non-disclosure requirements. Result: Confirm that employees understand the risks of discussing sensitive data in public and adhere to verbal transfer rules.

• Verify that staff have completed training on the secure use of communication tools.
• Check for awareness of the “Clear Desk and Clear Screen” policy in the context of data transfer.
• Ensure staff know how to report an accidental misdirected transfer or potential interception.

10. Inspect Incident Response logs for transfer-related breaches

Action: Review the incident register for any entries related to Annex A 5.14. Result: Confirm that transfer-related incidents are reported within the statutory thresholds required by GDPR, NIS2, or CIRCIA.

• Check that root cause analysis was performed for any data-in-transit breaches.
• Verify that lessons learned were incorporated into the Information Transfer Policy.
• Ensure that the reporting window (e.g. 72 hours) was met for any reportable personal data breaches.

Audit Checklist

Audit Check	What to Look For	Example Evidence	GRC Platform Check
1. Transfer Policy	Verify a formalised Information Transfer Policy exists and is approved.	Management-approved policy document dated within the last 12 months.	Policy module link to Annex A 5.14.
2. Transfer Agreements	Check for signed agreements (ITAs/NDAs) for sensitive external data movement.	Executed contracts or Standard Contractual Clauses (SCCs) with third parties.	Supplier Risk Management record.
3. Secure Channels	Confirm technical encryption is enforced for all electronic data in transit.	Technical configuration showing TLS 1.3 or AES-256 mandatory settings.	Control automation monitor.
4. Access Review	Inspect access logs for transfer facilities (e.g. SFTP, MFT) to ensure least privilege.	User access list review signed off by the System Owner.	Access Review workflow history.
5. Physical Media	Audit the chain of custody for the physical transport of hard drives or tapes.	Signed courier handover logs and proof of media-at-rest encryption.	Asset register transport log.
6. Integrity Checks	Verify that digital signatures or hashes are used to detect data tampering.	Log files showing successful SHA-256 checksum verifications upon receipt.	Automated evidence upload.
7. Verbal Disclosure	Confirm staff are trained on non-disclosure during verbal communication.	Security awareness training records with 100% completion rate.	Training compliance dashboard.
8. Incident Reporting	Review incident logs for misdirected transfers or unauthorised disclosures.	Incident tickets with root cause analysis and remediation actions.	Incident Management module.
9. Facility Inventory	Verify all transfer gateways and APIs are identified and risk-assessed.	Inventory list within the Asset Register.	Asset Management inventory.
10. Monitor & Log	Ensure all transfer activities are logged and integrated into a SIEM.	Screenshots of SIEM dashboards showing data transfer alerts.	Continuous monitoring feed.

How to pass an ISO 27001 Annex A 5.14 audit

To pass an audit of ISO 27001 Annex A 5.14 you are going to make sure that you have followed the steps above in how to comply.

What the auditor will check

The audit is going to check a number of areas. Lets go through them

1. That you have not done something stupid

The auditor is going to check the rules, procedures and agreements and make sure you followed them. As with everything having documented evidence of anything you can is going to be your friend. So practical things like physical media transfer logs, risk register items and evidences of training. Work through each transfer type and look for the gotchas. Sure you use a secure courier but did you agree it and have them listed some where? Sure you start every conversation with a disclaimer, and now for shits and giggles, with the auditor would be the time to polish off and demonstrate your unique verbal skills.

2. That you have rules, processes, agreement and you have followed them and have trained people

This is obvious but they are going to look that you have documented what you say you do, that you follow it and that you have trained people.

3. Documentation

They are going to look at audit trails and all your documentation and see that is classified and labelled. All the documents that you show them, as a minimum if they are confidential should be labelled as such. Doing anything else would be a massive own goal.

Top 3 Mistakes People Make and How to Avoid Them

The top 3 Mistakes People Make For ISO 27001 Annex A 5.14 are

1. Your teams go around you and do what they want because your controls make their life a living hell

Be practical and realistic in what you put in place. No one likes a smart arse but they hate people who make their job more difficult way more. If you make it too hard they will just go around you. You have ZERO way to check, audit or impose on private conversations or private communications over things like WhatsApp and text. It just isn’t realistic. Don’t be a dick, be someone who takes the spirit of what is required and implements in with reasoned appropriateness. This is a risk based management system. Not a rule based system. Controls are for consideration and the level you implement is down to you and the risk to your business.

2. One or more members of your team haven’t done what they should have done

Prior to the audit check that all members of the team have done what they should have, understand how to transfer information and have been trained in it.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

Applicable Laws and Related Standards

Standard / Law	Relevant Control / Provision	The “How”: Mapping to ISO 5.14
NIST 800-53 Rev 5	AC-4, SC-8, PE-16	Enforces information flow policies (AC-4) and transmission confidentiality/integrity (SC-8) via encryption. PE-16 manages physical media transfer.
NIS2 Directive (EU)	Article 21 (Risk Management)	Requires security of the supply chain and data-in-transit. Organizations must ensure transfer facilities are resilient against interception and disruption.
DORA (EU)	Articles 28–30	Mandates secure data portability and interoperability during the transfer of functions between ICT third-party service providers.
SOC 2 (TSC)	CC6.1, CC6.7	Focuses on logical access to data in transit and boundary protection to ensure information is only transferred via authorized, encrypted channels.
EU AI Act	Article 10 (Data Governance)	Requires the secure transfer and lineage tracking of training/validation datasets to prevent data poisoning or unauthorized manipulation.
UK Data (Use & Access) Act 2025	Data Protection Test	Replaces ‘Essential Equivalence’ with a risk-based assessment for international transfers, requiring updated transfer agreements (IDTAs).
UK Cyber Security & Resilience Bill	MSP Supply Chain Security	Expands 5.14 to include mandatory reporting of incidents occurring during data transfers managed by service providers.
CIRCIA (USA)	72-Hour Reporting	Requires monitoring of transfer facilities to detect and report unauthorized data exfiltration within strict legal timelines.
EU Product Liability Directive (PLD)	Strict Software Liability	Extends liability to software flaws; insecure transfer mechanisms in commercial software are now legally classified as product defects.
ECCF (European Cert Framework)	Harmonized Security Labels	Aligns 5.14 with EU-wide certification for cloud services, ensuring standardized encryption and transfer protocols are verified.
HIPAA (USA)	§164.312(e)(1)	Requires transmission security for ePHI, including integrity controls (hashing) and encryption to protect health data during transfer.
CCPA / CPRA (California)	Contractual Restrictions	Mandates that data transfer agreements explicitly prohibit the recipient from ‘selling’ or ‘sharing’ data outside the defined business purpose.
GDPR (EU)	Articles 32, 44-50	Requires technical measures (encryption) and legal mechanisms (SCCs) to ensure the protection of personal data during cross-border transfers.

FAQ

Applicability of across different business models

Business Type	Applicability & Interpretation	Examples of Control
Small Businesses	Stop Emailing Passwords. Small teams often over-rely on email. Compliance means establishing a “Rule” that sensitive data (passwords, bank details) must never be sent via plain email, but via secure links.	• Secure Links: Using features like “SharePoint – Specific People” links with an expiry date instead of attaching Excel files directly to emails. • Verbal Hygiene: A policy forbidding the discussion of client financial details in public coffee shops or co-working spaces.
Tech Startups	Automated & API Security. Transfers aren’t just files; they are API calls. Auditors verify that data flowing between your microservices and external tools (Slack, Jira, AWS) is encrypted in transit.	• TLS Enforcement: Configuring load balancers to reject any connection below TLS 1.2 to ensure all web traffic is encrypted. • Public Link Ban: Configuring Google Drive/Dropbox settings to disable “Anyone with the link can view,” forcing users to explicitly invite recipients.
AI Companies	Bulk Data Ingestion. Moving terabytes of training data requires specific agreements. You must ensure that data sent to third-party model providers (e.g., OpenAI API) is governed by a secure transfer protocol.	• Authenticated Endpoints: Using Mutual TLS (mTLS) or signed URLs for ingesting client datasets into S3 buckets, ensuring no “man-in-the-middle” attacks. • Sanitization Before Transfer: A procedure to scrub PII from datasets locally before transferring them to a cloud training environment.

Related ISO 27001 Controls and Further Reading

• ISO 27001 Annex A 5.20 Addressing Information Security Within Supplier Agreements
• ISO 27001 Annex A 5.36 Compliance With Policies, Rules And Standards For Information Security
• The complete guide to ISO/IEC 27002:2022
• ISO 27001 Risk Treatment – Tutorial

ISO 27001 controls and attribute values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Confidentiality	Protect	Information protection	Protection
	Integrity			Asset management
	Availability

About the author