Information Transfer Policy Template (ISO/IEC 27001 A.5.14)

Information Transfer Policy: [Organization name]

Topic-specific policy that sets the rules for moving information inside [Organization name] and between it and external parties, by any channel: e-mail, file sharing, managed file transfer, APIs, removable media, courier and verbal communication. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A control A.5.14 (information transfer), with A.8.24 (use of cryptography), A.6.6 (confidentiality agreements), A.5.20 (supplier agreements), A.7.10 (storage media) and A.8.12 (data leakage prevention), using guidance from ISO/IEC 27002:2022. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. Roles and responsibilities
3. Transfer types and approved channels
4. Rules per classification level
5. Encryption and integrity
6. Agreements with external parties
7. Cross-border transfers of personal data
8. API and system-to-system transfers
9. Verbal, phone and video communication
10. Physical transfer: media, paper and courier
11. Prohibited channels and practices
12. Logging, monitoring and DLP
13. Exceptions and incidents
14. Size tiers
15. Records and evidence
16. References

1. Purpose and scope

This policy protects information while it moves, so that it reaches only the intended recipient, arrives unchanged and stays protected under terms both parties have agreed. It applies to every transfer of information in the ISMS scope (DOC-ISMS-002):

• between people inside [Organization name], across teams, sites and legal entities;
• from [Organization name] to customers, suppliers, partners, auditors, regulators and the public;
• from external parties to [Organization name];
• between systems, through APIs, file transfers, integrations and data pipelines;
• by physical means: removable media, paper, devices and couriers;
• by speech: meetings, phone calls, video calls and voice messages.

It applies to employees, contractors and third parties acting for [Organization name]. Transfers of personal data are also subject to the legal and contractual requirements recorded in the legal register (compliance/legal-register, DOC-ISMS-014).

2. Roles and responsibilities

3. Transfer types and approved channels

4. Rules per classification level

4.1 Channel matrix

4.2 General rules for every transfer

4.3 Choosing a channel

The diagram covers the common electronic channels. Physical and verbal transfers follow sections 9 and 10.

5. Encryption and integrity

• All network transfers of Internal information and above are encrypted in transit using the protocol versions and cipher suites in the cryptography standard (security/cryptography-standard): TLS 1.3 by default, TLS 1.2 only where a named client population needs it.
• E-mail servers offer TLS to all domains and enforce TLS for partner domains that receive Confidential information regularly. SPF, DKIM and DMARC records are published for every company domain, including domains that send no mail, and inbound mail is checked against the sender's SPF, DKIM and DMARC results.
• Restricted information sent outside the organisation is encrypted at the file or message level in addition to the transport, so that it stays protected at rest on the recipient's side until opened.
• Large or Restricted file transfers carry an integrity check (cryptographic hash published through a separate channel or verified automatically by the managed transfer service).
• Encryption keys and passwords for file-level encryption are shared out of band, for example by phone or through the recipient's account on the transfer service, never in the same message as the file.
• Keys used by transfer services and integrations are recorded in the cryptographic key and certificate register (isms/cryptographic-key-register, DOC-ISMS-070).

6. Agreements with external parties

6.1 Agreement types

6.2 Minimum content of a transfer agreement

Every agreement that covers transfers of Confidential or Restricted information addresses at least:

• the information covered, its classification and any labels the recipient must keep;
• the purpose, and a ban on use for any other purpose;
• the approved channels and the encryption required;
• who may access the information on the recipient's side, including onward transfer and subcontractors;
• the recipient's protection duties, including storage, retention and return or destruction at the end;
• notification of incidents, with a time limit agreed by the parties;
• responsibilities and liabilities if information is lost or misused;
• the right to verify compliance (audit, questionnaire or report);
• for personal data, the processing terms and any cross-border transfer mechanism (section 7);
• for software or scripts exchanged, the integrity and provenance checks required.

Legal counsel confirms that agreements meet the laws that apply to each party; this policy does not decide which laws apply.

7. Cross-border transfers of personal data

Some data protection laws restrict transfers of personal data outside a country or region. For example, the EU GDPR (Regulation (EU) 2016/679) sets the conditions for transfers outside the European Economic Area in Chapter V, and other jurisdictions have their own rules. [Organization name] applies these rules:

• The privacy lead or DPO keeps a list of personal data flows that cross borders, including remote access and support from other countries, linked to the records of processing (compliance/gdpr-ropa or an equivalent record).
• Each cross-border flow has a documented legal basis or transfer mechanism recorded in the legal register (DOC-ISMS-014) and, where the law or the privacy lead requires it, a transfer impact assessment (compliance/transfer-impact-assessment).
• New cross-border flows are approved by the privacy lead before data is sent.
• Customer contracts that restrict data location are recorded and checked before a transfer, integration or support arrangement starts.

8. API and system-to-system transfers

The sequence below shows a Restricted file transfer to a partner over the managed file transfer service (CH-004), with the decryption key sent by a separate channel as TRF-RULE-005 requires.

9. Verbal, phone and video communication

• Do not discuss Confidential or Restricted information in public places, on public transport or where others can overhear.
• Start meetings that cover Restricted topics by stating the level and checking that only invited participants are present.
• Do not leave Confidential or Restricted details in voicemail.
• Verify the identity of a caller before giving Confidential information: call back on a number from a trusted source (contract, internal directory), not the number the caller gives.
• Requests to change payment details, release funds, reset credentials or send bulk data are confirmed by a second channel and, for payments, by a second person, even when the request seems to come from a senior manager by phone or video. Voice and video can be imitated.
• Recording of meetings is allowed only on the corporate platform, with participants informed; recordings inherit the meeting classification.

10. Physical transfer: media, paper and courier

• Removable media used for transfer is company-issued and encrypted (CH-008). The decryption password is sent by a separate channel.
• Media and paper are packed so that the content is not visible, with no classification label on the outer packaging.
• Restricted shipments use tracked courier with signature (CH-009), double envelope or tamper-evident packaging, and the recipient confirms receipt; the sender records the shipment in the transfer log.
• Devices sent for repair or return are wiped first or sent to a supplier under an agreement that covers confidentiality and data handling.
• Media at the end of its use is sanitised or destroyed and recorded (isms/equipment-disposal-reuse-record, DOC-ISMS-057).

11. Prohibited channels and practices

12. Logging, monitoring and DLP

• Transfer services (CH-002 to CH-006) log sender, recipient, time, size and file name; logs are kept as set in security/security-logging-standard. Removable media (CH-008) and courier (CH-009) shipments are recorded in the shipment register (section 15).
• DLP rules block or warn on transfers that break section 4, based on classification labels and content detectors (isms/data-masking-dlp-standard, DOC-ISMS-062). Alerts are triaged by the security team within [1 working day].
• External sharing links and guest accounts are reviewed [quarterly] by site owners; links older than their expiry are removed automatically.
• The Restricted transfer log (TRF-RULE-006) is reviewed [quarterly] by the information owners.
• Metrics reported [quarterly] to the steering committee:

The example results describe one quarter at Quillmere Health Systems.

13. Exceptions and incidents

• Deviations from this policy are requested with the security exception request (security/security-exception-request, DOC-ISMS-122), with compensating controls and an expiry date of no more than [12 months].
• A transfer to the wrong recipient, through a prohibited channel or without an agreement is reported at once through the security event reporting procedure (isms/security-event-reporting-procedure, DOC-ISMS-023). The security team decides whether it is an incident (compliance/incident-response-plan, DOC-ISMS-020) and whether it is a personal data breach (compliance/personal-data-breach-assessment).
• The sender attempts recall or asks the recipient to delete the information and confirm deletion in writing.
• Deliberate breaches are handled under the disciplinary process (isms/security-disciplinary-process, DOC-ISMS-052).

14. Size tiers

15. Records and evidence

16. References

Related templates: isms/information-labelling-handling-procedure (DOC-ISMS-042), data/data-classification-policy, security/cryptography-standard, isms/confidentiality-nda (DOC-ISMS-051), isms/supplier-security-agreement-27036 (DOC-ISMS-068), legal-lite/dpa, compliance/data-sharing-agreement, compliance/transfer-impact-assessment, isms/data-masking-dlp-standard (DOC-ISMS-062), isms/cryptographic-key-register (DOC-ISMS-070), isms/control-evidence-matrix (DOC-ISMS-033).

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024, Annex A control A.5.14 with A.5.20, A.6.6, A.7.10, A.8.12 and A.8.24, and with the guidance in ISO/IEC 27002:2022. The policy text, channel register, rule IDs, examples and guidance are original wording; ISO/IEC text is not reproduced, and the short control labels are descriptions written for this library, not official titles. ISO and IEC standards are copyrighted: obtain the official standards from ISO (https://www.iso.org/standard/82875.html) or your national standards body. Laws are named only as international examples; ask legal counsel which apply to you. Check the current editions of all referenced standards before use. This is a documentation format, not legal advice. Template licence: MIT.