## 5.14 Information transfer

| Control type | Information security properties           | Cybersecurity concepts | Operational capabilities                  | Security domains |
| ------------ | ----------------------------------------- | ---------------------- | ----------------------------------------- | ---------------- |
| #Preventive  | #Confidentiality #Integrity #Availability | #Protect               | #Asset_management #Information_protection | #Protection      |

**Control**
Information transfer rules, procedures, or agreements should be in place for all types of transfer facilities within the organization and between the organization and other parties.

**Purpose**
To maintain the security of information transferred within an organization and with any external interested party.

**Guidance**

<u>General</u>
The organization should establish and communicate a topic-specific policy on information transfer to all relevant interested parties. Rules, procedures and agreements to protect information in transit should reflect the classification of the information involved. Where information is transferred between the organization and third parties, transfer agreements (including recipient authentication) should be established and maintained to protect information in all forms in transit (see 5.10).

Information transfer can happen through electronic transfer, physical storage media transfer and verbal transfer.

For all types of information transfer, rules, procedures and agreements should include:

a\) controls designed to protect transferred information from interception, unauthorized access, copying, modification, misrouting, destruction and denial of service, including levels of access control commensurate with the classification of the information involved and any special controls that are required to protect sensitive information, such as use of cryptographic techniques (see 8.24);

b\) controls to ensure traceability and non-repudiation, including maintaining a chain of custody for information while in transit;

c\) identification of appropriate contacts related to the transfer including information owners, risk owners, security officers and information custodians, as applicable;

d\) responsibilities and liabilities in the event of information security incidents, such as loss of physical storage media or data;

e\) use of an agreed labelling system for sensitive or critical information, ensuring that the meaning of the labels is immediately understood and that the information is appropriately protected (see 5.13);

f\) reliability and availability of the transfer service;

g\) the topic-specific policy or guidelines on acceptable use of information transfer facilities (see 5.10);

h\) retention and disposal guidelines for all business records, including messages;

NOTE Local legislation and regulations can exist regarding retention and disposal of business records.

i\) the consideration of any other relevant legal, statutory, regulatory and contractual requirements (see 5.31, 5.32, 5.33, 5.34) related to transfer of information (e.g. requirements for electronic signatures).

<u>Electronic transfer</u>
Rules, procedures and agreements should also consider the following items when using electronic communication facilities for information transfer:

a\) detection of and protection against malware that can be transmitted through the use of electronic communications (see 8.7);

b\) protection of communicated sensitive electronic information that is in the form of an attachment;

c\) prevention against sending documents and messages in communications to the wrong address or number;

d\) obtaining approval prior to using external public services such as instant messaging, social networking, file sharing or cloud storage;

e\) stronger levels of authentication when transferring information via publicly accessible networks;

f\) restrictions associated with electronic communication facilities (e.g. preventing automatic forwarding of electronic mail to external mail addresses);

g\) advising personnel and other interested parties not to send short message service (SMS) or instant messages with critical information since these can be read in public places (and therefore by unauthorized persons) or stored in devices not adequately protected;

  

h\) advising personnel and other interested parties about the problems of using fax machines or services, namely:

  

1\) unauthorized access to built-in message stores to retrieve messages;

  

2\) deliberate or accidental programming of machines to send messages to specific numbers.

  

<u>Physical storage media transfer</u>

  

When transferring physical storage media (including paper), rules, procedures and agreements should also include:

  

a\) responsibilities for controlling and notifying transmission, dispatch and receipt;

  

b\) ensuring correct addressing and transportation of the message;

  

c\) packaging that protects the contents from any physical damage likely to arise during transit and in accordance with any manufacturers’ specifications, for example protecting against any environmental factors that can reduce the effectiveness of restoring storage media such as exposure to heat, moisture or electromagnetic fields; using minimum technical standards for packaging and transmission (e.g. the use of opaque envelopes);

  

d\) a list of authorized reliable couriers agreed by management;

  

e\) courier identification standards;

  

f\) depending on the classification level of the information in the storage media to be transported, use tamper evident or tamper-resistant controls (e.g. bags, containers);

  

g\) procedures to verify the identification of couriers;

  

h\) approved list of third parties providing transportation or courier services depending on the classification of the information;

  

i\) keeping logs for identifying the content of the storage media, the protection applied as well as recording the list of authorised recipients, the times of transfer to the transit custodians and receipt at the destination.

  

<u>Verbal transfer</u>

  

To protect verbal transfer of information, personnel and other interested parties should be reminded that they should:

  

a\) not have confidential verbal conversations in public places or over insecure communication channels since these can be overheard by unauthorized persons;

  

b\) not leave messages containing confidential information on answering machines or voice messages since these can be replayed by unauthorized persons, stored on communal systems or stored incorrectly as a result of misdialling;

  

c\) be screened to the appropriate level to listen to the conversation;

  

d\) ensure that appropriate room controls are implemented (e.g. sound-proofing, closed door);

  

e\) begin any sensitive conversations with a disclaimer so those present know the classification level and any handling requirements of what they are about to hear.

  

**Other information**

No other information.