A.5.14 Information transfer
Put rules, procedures or agreements in place for every way information moves, inside and outside the organization.
15
artefacts
4
held by a system
2
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Secure file transfer (SFTP) activity logs · SIEM / log platform
- Email encryption usage logs · SIEM / log platform
- Archive of data loss prevention alerts · SIEM / log platform
- Certificates of completion for phishing awareness training · HR system / LMS
periodic reviewEvidence produced at each review
- Signed data transfer agreements with external partners · Vendor register / contract repository
- Attendance records for employee training on secure data transfer · HR system / LMS
governing documentDocuments that govern the control
- Information Transfer Policy document · Policy repository / GRC workspace
- Data Classification and Transfer Guidelines · Policy repository / GRC workspace
- Minutes of policy approval meeting · Policy repository / GRC workspace
- Service Level Agreements that include data handling clauses · Vendor register / contract repository
- Non‑Disclosure Agreements for data exchange · Vendor register / contract repository
- Standard Operating Procedure for encrypted email transmission · Policy repository / GRC workspace
- Procedure for secure file transfer using SFTP · Policy repository / GRC workspace
- Checklist for handling removable media · Policy repository / GRC workspace
- Records of periodic refresher training on transfer policies · HR system / LMS
First move
Start with the 4 of 15 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Reliance on informal verbal agreements
- Missing logs for ad-hoc transfers
- No periodic review of transfer agreements
- Inconsistent application across business units
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet