## 5.10 Acceptable use of information and other associated assets

| Control type | Information security properties           | Cybersecurity concepts | Operational capabilities                  | Security domains                      |
| ------------ | ----------------------------------------- | ---------------------- | ----------------------------------------- | ------------------------------------- |
| #Preventive  | #Confidentiality #Integrity #Availability | #Protect               | #Asset_management #Information_protection | #Governance_and_Ecosystem #Protection |

**Control**
Rules for the acceptable use and procedures for handling information and other associated assets should be identified, documented and implemented.

**Purpose**
To ensure information and other associated assets are appropriately protected, used and handled.

**Guidance**
Personnel and external party users using or having access to the organization’s information and other associated assets should be made aware of the information security requirements for protecting and handling the organization’s information and other associated assets. They should be responsible for their use of any information processing facilities.

The organization should establish a topic-specific policy on the acceptable use of information and other associated assets and communicate it to anyone who uses or handles information and other associated assets. The topic-specific policy on acceptable use should provide clear direction on how individuals are expected to use information and other associated assets. The topic-specific policy should state:

a\) expected and unacceptable behaviours of individuals from an information security perspective;

b\) permitted and prohibited use of information and other associated assets;

c\) monitoring activities being performed by the organization.

Acceptable use procedures should be drawn up for the full information life cycle in accordance with its classification (see 5.12) and determined risks. The following items should be considered:

a\) access restrictions supporting the protection requirements for each level of classification;

b\) maintenance of a record of the authorized users of information and other associated assets;

c\) protection of temporary or permanent copies of information to a level consistent with the protection of the original information;

d\) storage of assets associated with information in accordance with manufacturers’ specifications (see 7.8);

e\) clear marking of all copies of storage media (electronic or physical) for the attention of the authorized recipient (see 7.10);

f\) authorization of disposal of information and other associated assets and supported deletion method(s) (see 8.10).

**Other information**
It can be the case that the assets concerned do not directly belong to the organization, such as public cloud services. The use of such third-party assets and any assets of the organization associated with such external assets (e.g. information, software) should be identified as applicable and controlled, for example, through agreements with cloud service providers. Care should also be taken when a collaborative working environment is used.