ISO 27001 Annex A 5.32 is an ISO 27001 control that wants you to understand external requirements on you from intellectual property and implement them.
In this guide you will learn how to implement ISO 27001 Annex A 5.32 Intellectual Property Rights and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.
Table of contents
Purpose & Definition
The purpose of ISO 27001 Annex A 5.32 Intellectual Property Rights is to ensure you comply with legal, statutory, regulatory and contractual requirements related to intellectual property.
The standard includes copyright for software and documents as well as all legal terms such as trademarks, patents, licenses.
The ISO 27001 standard defines ISO 27001 Annex A 5.32 as:
The organisation should implement appropriate procedures to protect intellectual property rights.
ISO/IEC 27001:2022 Annex A 5.32 Intellectual Property Rights
White Label
ISO 27001 for Consultants
Custom-brandable ISO 27001 documentation for consultants. Easily rebrand, reduce project time, and deliver professional, high-value security systems. Focus on delivery, not drafting.
ISO 27001 Annex A 5.32 Training Video
In this free training video you will learn How to implement ISO 27001 Intellectual Property Rights (Annex A 5.32) and Pass Your Audit.
Implementation Guide
Annex A 5.32 requirements are to understand and record the requirements on intellectual property from any legal, statutory, regulatory or contractual requirements. We need to protect anything that might be considered intellectual property.
Intellectual property topic specific policy
Having an ISO 27001 topic specific policy that is agreed and communicated on the protection of intellectual property rights. A prewritten topic specific policy on intellectual property is part of the ISO 27001 Policy Pack.
Procedures for intellectual property
You will develop and implement procedures and processes that deal with the compliance of intellectual property and that includes the use of software. Your policy and procedures will ensure that only licensed software and products are used and they are used in line with the intellectual property agreements.
Software license register
It is best practice to hold a register of all the software that you have and use and to record information related to it. You will consider recording the type of license, the license expiry, holding a copy of the license, any limitations of the license, how many copies you have purchased, how many are actually used and by whom.
Software use reviews
You will have the register but you should also perform periodic reviews of what you are actually using. You want to be sure you are using licensed products and that not exceeding any license units purchased.
Software transfer and disposal
You will have in place processes and procedures for when you no longer use or need software or when it is transferred between users and entities.
Software Terms and Conditions
It goes without saying that you will comply with the terms and conditions of the software and products that you are using.
Copyright
You will respect the law and the copyright of others.
Check Your Work?
You built it yourself. Maybe with AI. But will it pass the audit?
Don’t gamble – let an ISO 27001 Lead Auditor check your work.
How to Implement ISO 27001 Annex A 5.32
Implementing ISO 27001 Annex A 5.32 ensures your organisation protects its most valuable assets: its ideas, code, and proprietary data. As an ISO 27001 Lead Auditor, I expect to see more than just a policy: I look for evidence that you have identified your intellectual property, managed your software licences, and legally protected your work. Follow these ten steps to formalise your Intellectual Property Rights (IPR) framework and satisfy rigorous audit requirements.
1. Formalise a Topic-Specific Policy on IPR
Formalise a mandatory IPR policy that defines the organisation’s approach to protecting its own assets and respecting third-party rights: this ensures a clear legal baseline is established across the workforce.
- Identify the specific legal and regulatory requirements for your jurisdiction.
- Define clear rules regarding the use of open-source software (OSS) and proprietary code.
- Document the consequences for policy violations to ensure staff accountability.
2. Provision IPR Details into the Asset Register
Provision the Asset Register to include specific classifications for intellectual property such as source code, patents, and trademarks: this provides the visibility needed to apply appropriate technical controls.
- Identify the “Owner” for every piece of intellectual property documented.
- Record the location of the assets, whether they reside in cloud repositories or on-premise servers.
- Link the IPR assets to your broader ISMS risk assessment process.
3. Provision Software Asset Management (SAM) Tools
Provision technical tools to monitor and manage software installations across the estate: this prevents the legal risk of running unlicensed or unauthorised software.
- Deploy agents to track software versioning and installation counts.
- Centralise the storage of licence keys and proof-of-purchase documentation.
- Identify and block the installation of “Shadow IT” or peer-to-peer software.
4. Audit Software Licences for Compliance
Audit your current software usage against active licence entitlements: this result prevents litigation and financial penalties from software vendors.
- Compare tool-based installation reports with the master contract list.
- Ensure that subscription-based services (SaaS) are properly allocated to active users.
- Identify any surplus licences to reduce technical debt and operational costs.
5. Review and Formalise Employment Agreements
Review all employment and contractor agreements to ensure they contain enforceable IPR ownership clauses: this ensures that any work created for the business remains the property of the organisation.
- Ensure the “Work for Hire” principle is explicitly documented in all contracts.
- Include non-disclosure agreements (NDAs) as a standard requirement for all staff.
- Review the Rules of Engagement (ROE) documents for third-party consultants.
6. Provision Role-Based Access Control (RBAC) via IAM
Provision strict Identity and Access Management (IAM) roles to limit access to sensitive IPR: this result ensures that only authorised personnel can view or modify proprietary information.
- Apply the principle of least privilege to source code repositories and design documents.
- Mandate Multi-Factor Authentication (MFA) for all administrative or developer-level access.
- Review access logs monthly to identify any anomalous behaviour surrounding IPR assets.
7. Implement Technical Labelling and Digital Watermarking
Implement a labelling scheme that identifies proprietary information through metadata or visible watermarks: this ensures that users are aware of the sensitivity and legal status of the data they handle.
- Use automated Data Loss Prevention (DLP) tools to scan for and label sensitive content.
- Apply digital signatures to proprietary software releases to ensure integrity and origin.
- Document the labelling standard within your Information Classification Policy.
8. Audit Third-Party Supplier and Client Contracts
Audit the security and IPR clauses within third-party contracts: this result ensures that your suppliers respect your intellectual property and that you are not infringing on theirs.
- Verify that vendors are contractually obligated to protect your sensitive data.
- Check for “Right to Audit” clauses to verify vendor compliance with IPR protections.
- Identify any specific contractual requirements for the return or destruction of data upon contract termination.
9. Revoke Access and Manage Secure Disposal
Revoke access rights immediately upon a member of staff or contractor leaving the organisation: this result prevents the unauthorised exfiltration of proprietary data post-employment.
- Automate the “Leaver” process within your IAM system.
- Verify that physical assets, such as laptops containing IPR, are returned and securely wiped.
- Collect signed exit statements reminding leavers of their ongoing legal obligations regarding IPR.
10. Audit the Effectiveness of IPR Controls Regularly
Audit your IPR controls through the internal audit programme to verify ongoing compliance: this result provides the final assurance needed for a successful ISO 27001 certification audit.
- Test a sample of software installations to verify they match the licence register.
- Review a sample of recent employee contracts to ensure compliance clauses are present.
- Document all findings in the Corrective Action Log to drive continuous ISMS improvement.
ISO 27001 Templates
ISO 27001 Annex A 5.32 FAQ
Yes, maintaining an accurate and up-to-date register of all software licences is a mandatory requirement to demonstrate compliance with Annex A 5.32. This register is the primary evidence used during Stage 1 and Stage 2 audits to prove that the organisation is not using “shadow IT” or pirated software.
The register must track the number of licences purchased versus the number of installations.
Auditors will look for proof that the organisation is not using “shadow IT” or pirated software.
It helps manage expiry dates to avoid operational disruption or legal penalties.
Proof of purchase (invoices or digital certificates) must be readily available as audit evidence.
Organisations manage software licence compliance by implementing technical Software Asset Management (SAM) tools to reconcile installed instances against active entitlements. With approximately 37% of software globally being unlicensed, auditors require evidence of regular reconciliations and technical blocks on unauthorised software installations to mitigate legal risks.
Yes, ISO 27001 requires that all proprietary information and creative works produced by the organisation are protected under relevant copyright laws. This ensures that the Information Security Management System (ISMS) safeguards the organisation’s competitive advantage and proprietary research from unauthorised exfiltration.
Employment contracts must explicitly state that IP created during work hours belongs to the employer.
Access controls should be implemented to prevent unauthorised copying of source code or research.
Watermarking or digital rights management (DRM) can be used as technical evidence of protection.
Third-party NDAs should include clauses that define IP ownership and usage rights.
ISO 27001 mandates that organisations using open-source software (OSS) must comply with the specific licence terms (e.g., GPL, MIT) associated with those libraries. Failure to manage OSS properly can lead to “licence contamination,” where proprietary code is legally forced into the public domain.
You must maintain a Software Bill of Materials (SBOM) to track open-source dependencies.
Risk assessments should evaluate the security and legal impact of specific OSS licences.
Usage must align with the organisation’s “Acceptable Use Policy” and legal standards.
Non-compliance with intellectual property rights can result in major audit non-conformities, significant legal fines often exceeding £500,000, and the potential revocation of software service agreements. Furthermore, using unlicensed software increases the risk of malware infection by 30%, directly compromising the integrity of the ISMS.
Unlicensed software often leads to security vulnerabilities due to a lack of official patches.
Copyright infringement claims can cause severe reputational damage to the brand.
Contractual breaches with clients regarding IP ownership can lead to litigation.
No, the use of personal software for business purposes is generally prohibited unless it is formally authorised, risk-assessed, and properly licensed for commercial use. Personal licences rarely cover “Commercial Use,” and allowing unmanaged software creates significant technical debt and security blind spots.
Personal licences rarely cover “Commercial Use,” leading to a breach of Annex A 5.32.
Authorisation must be documented in the software register or Acceptable Use Policy.
Technical controls (e.g., application whitelisting) should be used to prevent unauthorised installations.
The EU AI Act impacts IPR by requiring providers of high-risk AI models to document and publish summaries of the copyrighted data used for model training. In 2026, Annex A 5.32 implementation must account for these transparency obligations to ensure that AI model outputs do not inadvertently infringe upon third-party intellectual property.
Related ISO 27001 Controls
Further Reading
ISO 27001 Controls and Attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Availability | Identify | Lega and compliance | Governance and EcoSystem |
| Confidentiality | ||||
| Integrity |
Stuart Barker
ISO 27001 Ninja
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigour with extensive operational experience, including a decade leading Data Governance for General Electric (GE).
As a qualified ISO 27001 Lead Auditor, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. His toolkits represent an auditor-verified methodology designed to minimise operational friction while guaranteeing compliance.
- MSc Security
- ISO 27001 Lead Auditor
- 30+ Years Exp
- Ex-GE Leader