In this ultimate how to audit guide to ISO 27001 Annex A 5.32 Intellectual Property Rights, you will learn directly from an ISO 27001 Lead Auditor:
- 10 Key Audit Steps
- Verification Criteria
- Required Evidence
- The Pass / Fail Test
I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.
Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.
Table of contents
- 1. Intellectual Property Rights (IPR) Policy Formalisation Verified
- 2. Software Asset Register Completeness Confirmed
- 3. Proof of Entitlement for Commercial Software Validated
- 4. Open Source Software (OSS) Compliance Verified
- 5. Software Media and Licence Key Security Confirmed
- 6. Prohibition of Unauthorised Software Installation Verified
- 7. Intellectual Property Ownership Clauses in Contracts Confirmed
- 8. Digital Rights Management (DRM) and Watermarking Validated
- 9. Periodic Software Licence Audit Evidence Identified
- 10. Disposal of Licenced Assets Procedure Verified
Auditing ISO 27001 Annex A 5.32 is a systematic review to ensure an organization legally protects its proprietary assets and adheres to software licensing agreements. The Primary Implementation Requirement centers on maintaining an accurate software asset register, delivering the Business Benefit of litigation avoidance and robust data governance.
1. Intellectual Property Rights (IPR) Policy Formalisation Verified
Verification Criteria: A documented policy exists that defines the organisation’s approach to protecting its own IPR and respecting the IPR of third parties, including software licencing.
Required Evidence: Approved IPR Policy or integrated Legal Compliance Policy with specific sections on copyright, trademarks, and patents.
Pass/Fail Test: If the organisation lacks a formal policy statement regarding the legal use of third-party software or proprietary data, mark as Non-Compliant.
2. Software Asset Register Completeness Confirmed
Verification Criteria: An up-to-date inventory exists listing all software assets, including version numbers, install counts, and physical/logical locations.
Required Evidence: Software Asset Management (SAM) database or a verified spreadsheet showing the current software estate.
Pass/Fail Test: If the inventory fails to account for SaaS-based applications or ‘Shadow IT’ identified during technical discovery, mark as Non-Compliant.
3. Proof of Entitlement for Commercial Software Validated
Verification Criteria: The organisation possesses valid proof of ownership (licences, invoices, or digital entitlements) for all commercial software currently in use.
Required Evidence: Original licence certificates, EULAs (End User Licence Agreements), or procurement invoices matched to the software inventory.
Pass/Fail Test: If the number of active software installations exceeds the number of legally purchased licences, mark as Non-Compliant.
