What evidence do auditors commonly ask for on A.3.7 Information transfer?

Transfer procedures applying the PII processing rules to every transfer channel; Log of physical media containing PII sent and received with the fields the standard names; Authorisation records for media leaving the premises; Encryption of PII on media in transit.

What is the most common gap auditors find on A.3.7?

Transfer rules enforced inside the system but not on exports and extracts

ISO/IEC 27701:2025 · Annex A Table A.3 information security controls with PII-specific guidance

`A.3.7` Information transfer

The organization's rules and procedures for transferring information shall make sure the PII processing rules apply at every point within the system and, where relevant, beyond it. Where PII moves on physical media, a system shall log media coming in and going out, capturing the kind of media, the authorised sender and recipients, the date and time, and how many items were sent, and further safeguards such as encryption shall be applied where possible so that the PII can be read only at its destination. Physical media holding PII shall need authorisation before it leaves the premises and shall be kept out of reach of anyone other than authorised staff.

Source: ISO/IEC 27701:2025, A.3.7. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27701:2025 in the compliance library.

artefacts

held by a system

at each review

easy

to go live

Policy repository / GRC workspace

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Transfer procedures applying the PII processing rules to every transfer channel · Policy repository / GRC workspace
Log of physical media containing PII sent and received with the fields the standard names · Physical access / facilities

periodic reviewEvidence produced at each review

Authorisation records for media leaving the premises · Physical access / facilities

governing documentDocuments that govern the control

Encryption of PII on media in transit · Policy repository / GRC workspace

First move

Automate the pull from your Policy repository / GRC workspace. Version-controlled policy set with approval metadata; review dates tracked as records, not a calendar note.

Common gaps auditors find

Transfer rules enforced inside the system but not on exports and extracts
Physical media sent by courier with no log, no authorisation and no encryption

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

A.3.6 Labelling of information · A.3.8 Identity management