ISO 27001 A.5.10: acceptable use, explained for startups

A.5.10 Acceptable use of information and other associated assets

Staff agree to the rules for using company devices and data. What proves it: acceptable use rules every staff member has acknowledged, with the date.

A certification auditor samples signed acceptable use acknowledgements. A file that usually does the job: E-signature records or a human resources system report showing each person acknowledged the acceptable use policy.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.5.10 walks you through it in this order.

1. Approve the acceptable use policy in Policies.
2. Have every staff member acknowledge it at hire and each year.
3. Keep the acknowledgement records.

The free ISO 27001 readiness assessment asks one question that evidences it:

• Do staff acknowledge acceptable use rules?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Acceptable Use Policy covers A.5.10. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criteria that cover this ground: CC1.1, integrity and ethics and CC2.2, internal communication.

Organizational controls

A.5.10 is one of the 37 organizational controls in Annex A. How the company runs security: policies, roles, suppliers, incidents, continuity and legal duties. Most of these are written decisions and the records that show you follow them.

Nearby controls in the same theme:

• A.5.7, threat intelligence
• A.5.8, security in projects
• A.5.9, asset inventory
• A.5.11, returning assets
• A.5.12, classifying information
• A.5.13, labeling information

Before it: A.5.9, asset inventory. After it: A.5.11, returning assets. Every control, by theme, is on the Annex A controls page.