A.5.10 Acceptable use of information and assets: evidence

What A.5.10 acceptable use requires and why auditors test it in practice

When an auditor asks for your acceptable use rules and handling procedures, they want two things: a written set of rules that people actually received, and proof that handling changes with the sensitivity of the information. A.5.10 Acceptable use of information and other associated assets merges two 2013 controls, A.8.1.3 Acceptable use of assets and A.8.2.3 Handling of assets, into one requirement. The organization must identify the rules for acceptable use and the procedures for handling information and other associated assets, document them, implement them and communicate them to the people who use those assets. Handling has to cover each classification level as well as everyday use, so a laptop used for routine email and a system holding the most sensitive records should not be governed by the same unexplained habits.

The difficulty is usually not writing the policy. The common failure is that the rules exist as a document nobody has read, with no record of who was told, when, or in what form. The second failure is handling that differs by classification level on paper but cannot be shown in practice. An auditor will pick a sample of staff and ask them what they may do with confidential material, then ask for the acknowledgement, and then ask how a confidential file is stored, shared and disposed of compared with an internal one. Each answer has to match the others.

Before you commit to a plan, confirm three things with your certification body and your own records: which classification levels you use, which asset types the rules cover (endpoints, removable media, cloud workspaces, paper), and where each handling rule is recorded. Your ability to show acknowledgements and version history for these rules will decide how smoothly this control passes. The ISO/IEC 27001:2022 standard page gives the control's place in Annex A, and the guidance in ISO/IEC 27002 explains how the handling rules are usually expressed.

Which assets, people and third parties A.5.10 covers in your scope

A.5.10 applies wherever information and its supporting assets are used, so the scope decisions below determine how many rules, procedures and people the control reaches. Work through each category and record what is in and what is excluded, with the reason, before writing any handling rules.

Information in every form

Scope covers information in every form: documents, database records, email, chat and collaboration messages, and source code. Each form needs rules that fit how people create, share and delete it. A rule written only for documents will miss a developer pasting customer records into a ticket or a sales lead forwarding a spreadsheet by email. Check whether your inventory lists these forms separately or only as system names.

Devices and removable media

Laptops, phones, tablets, USB drives and external disks are associated assets that people carry outside the office. Acceptable use rules should state which devices may hold corporate information, which media may be connected, and how they are encrypted or wiped. Confirm whether personal devices used for work fall inside scope, since information on them still needs handling rules.

Cloud accounts and self-hosted platforms

Cloud tenants, SaaS subscriptions and self-hosted platforms such as wikis, file stores and ticketing systems are assets with their own users, sharing settings and admin rights. Rules should cover who may create shared links or export data, and whether personal accounts may be used for company work. Check that each platform's sharing and export features are listed in the rules, not just assumed to be controlled.

Paper and physical records

Printed material, whiteboard photos, notebooks and archive boxes are associated assets that A.5.10 covers as much as digital files. Rules should say when printing is allowed, where printed classified material is kept, and how it is destroyed. Confirm that the physical handling rules align with the clear-desk and disposal expectations in your physical controls.

Contractors and third parties

Contractors, temporary staff, consultants and service providers who handle your assets must follow the same acceptable use rules, or agreements must impose equivalent ones. Confirm which third parties receive access to information, how they acknowledge the rules, and which contracts reference them. Scope gaps often appear with outsourced development teams and managed service providers.

Handling rules by classification level

Handling rules should differ by classification level, so that public material, internal material and restricted data each have clear rules for sharing, storage, transfer and disposal. The classification scheme itself sits under A.5.12, but A.5.10 depends on it for handling. Ask for a written matrix that maps each level to permitted locations, transfer methods and destruction steps, and check that every asset category in scope appears in it.

How an assessor tests A.5.10 acceptable use and handling

This table walks through the test steps an assessor follows for A.5.10, with the evidence each step asks for and the findings that most often appear. Read it in order: the rules come first, then coverage by classification level, staff acknowledgement, asset handling and exceptions. The main takeaway is that an assessor judges handling by whether it matches the classification of the asset, so a policy that lists rules without linking them to classification levels is the most common weak point.

Test step	Evidence requested	Common findings
Read the documented rules	Acceptable use rules and handling procedures, with version, owner, approval and date of last review	Rules exist but have no owner, approval record or review date since they were written
Check coverage by classification level	Mapping of handling requirements for each classification level, such as storage, sharing, printing and disposal	Rules cover general use but say nothing about restricted or confidential information
Check coverage of asset types	List of asset types in scope, including information, devices, removable media, cloud accounts and paper records	Rules mention laptops only, leaving SaaS data, removable media and printed records unaddressed
Sample staff acknowledgement	Acknowledgement records or training completion for a sample of employees, with the version of the rules they accepted	Acknowledgements missing for new joiners or for staff who changed roles after the last update
Confirm contractors and third parties know the rules	Contract clauses, onboarding records or signed acknowledgements for contractors and temporary staff	Contractors have system access but were never told the acceptable use rules
Walk through handling of sample assets	Asset records for a sample of information and devices, with classification, location and disposal or return records	Handling in practice does not match the classification recorded for the asset, for example confidential files in shared public folders
Check exceptions	Exception register with approver, business reason, compensating measures and expiry date	Exceptions granted verbally or without an end date, so they persist after the reason has gone
Check review and corrective action	Records of compliance reviews and follow-up on past breaches or near misses	Breaches are handled as individual incidents with no change to the rules or training afterwards

Implementing A.5.10 step by step, with the output of each step

This sequence turns A.5.10 from a sentence in a policy into rules people can follow, approved and communicated to the people who use information and assets, with evidence of each step kept for the assessor. Each step produces a named artifact that the next step depends on.

Identify asset types and classification levels
Start by listing the kinds of information and associated assets in scope: documents, databases, laptops, mobile devices, removable media, cloud workspaces, printed records and physical access tokens. Ask the asset owners and the classification owner which levels apply, such as public, internal, confidential and restricted, and confirm the labels match the scheme in A.5.12. The output is a short register of asset types, each mapped to its classification level and a named owner. It is done when every asset type in the inventory has at least one owner and one level.
Draft acceptable use rules and handling procedures
For each asset type and classification level, write what users may and may not do: where information may be stored, who may receive it, whether it may leave managed devices, how it is shared outside the organization, and how it is disposed of. Keep the rules short enough that a new joiner can apply them without help. Separate general acceptable use rules from handling procedures for each level, since the control covers both. The output is a draft rule set with one handling table per classification level, reviewed by the asset owners and by security.
Approve and publish the rules
Route the draft to the people who own the policy framework, usually the information security lead with sign-off from management, and record the approval date and version. Publish the approved text in the location where staff look for policies, such as a wiki or document system with version history, so that the current version is easy to find and older versions remain traceable. The output is an approved, versioned document with an owner, an approval record and a stated location. It is done when a reviewer can open the current version and see who approved it and when.
Communicate the rules and collect acknowledgements
Brief the people who use information and assets, including employees, contractors and relevant third parties where the rules apply to them. Explain the rules through short training or onboarding material, then ask each person to acknowledge that they have read and understood them. Track completion per person and set a follow-up for anyone who has not acknowledged. The output is a dated acknowledgement record per user, plus the training material used. Auditors commonly sample these records against the user population from the access and identity lists, so they should match.
Link the rules to the asset inventory and labelling
Connect each asset in the inventory to its classification level and the handling rule that applies, and make sure labels on documents, systems and media show the same level. Where a tool supports it, set the classification as a required field so new assets cannot be recorded without one. Spot-check a sample of assets against the inventory to confirm the link is accurate. The output is an inventory in which each asset carries its owner, level and applicable handling rule. It is done when the sample shows no asset without a level.
Monitor compliance and correct gaps
Check whether the rules are followed in practice, through spot checks of shared locations, device reports, data loss prevention alerts where these exist, and review of exceptions raised by users. Record each deviation, decide whether it needs a corrective action, retraining or a rule change, and track it to closure. Confirm that the check is performed by someone who does not own the asset being checked where practical. The output is a compliance log showing checks performed, findings and actions closed, which is the evidence that the control operates rather than only exists on paper.
Review the rules on a set cycle
Review the rules at a planned interval and after significant changes, such as a new classification level, a move to a new cloud service, a change in regulation or a material incident. Confirm the rules still match how information is actually used, update the version history and repeat the approval and communication steps for any changed rule. The review cycle itself should be written down, with the interval the organization has chosen and the reason for it. The output is a review record with its date, reviewer, findings and the new version number, ready for an assessor to sample.

Who owns A.5.10 inside your team, a partner and the auditor

Your organization owns A.5.10 in full. The acceptable use rules and handling procedures are management decisions about how people may use information and assets, and they must reflect your business, your classification scheme and your legal and contractual duties. Someone accountable must approve them, enforce them and decide what happens when they are broken. An outside partner can help write the material, but the approval, the enforcement and the consequences stay with you.

Approval: a named role, such as the CISO or information security committee, signs off the rules and each later revision.
Enforcement: managers apply the rules in daily work and record exceptions and breaches with a decision.
Consequences: HR and legal agree how violations are handled, consistent with your disciplinary process.
Ownership of handling rules: asset and information owners confirm handling requirements for the data they are responsible for.
Review: the owner decides when the rules are reviewed and records the outcome.

Before any work starts, confirm which person signs the policy, who receives the acknowledgements and who can change the rules without going back to the approver.

Evidence that passes an A.5.10 audit and how to keep it current

An auditor testing A.5.10 looks for one connected chain: an approved policy, handling rules by classification level, proof that people received them, and records showing the rules were applied to real assets. Each artifact below has a different owner and review rhythm, so the goal is to keep each one current in its own cycle rather than rebuilding the whole set before every audit.

Approved acceptable use policy

The acceptable use rules themselves, approved by a named owner and version controlled with an approval date. Auditors check that the document covers everyday use of information and assets and sets out the rules for each classification level, and that it matches what staff are actually told. Confirm the approver is someone with authority over the ISMS, and that the policy links to the topic-specific policies it sits under.

Handling procedures by classification level

Step-by-step handling rules for each classification level, covering storage, sharing, printing, removable media, transfer and disposal. These procedures turn the classification scheme in A.5.12 into daily actions. Check that each level has a clear rule for every common handling situation, and that staff can find the level's rules from the label they see on a document.

Acknowledgement records

Signed or electronically recorded confirmations that each person has read and accepted the acceptable use rules, with the version they accepted and the date. Auditors sample these against the current staff list, so new joiners, contractors and changed roles need acknowledgements too. Confirm that the record captures the version, not just the name, so a later policy change can be tracked against who must re-accept it.

Communication and training records

Evidence that the rules were communicated to the people who use assets, such as course completion, briefing attendance and reminders. Learning platforms can record completion when a learner finishes an activity, which gives a dated trail. Confirm that completion is set to reflect the condition you intend, such as viewing versus passing an assessment, because auditors will ask what completion actually proves.

Handling records for sampled assets

Records showing that specific assets were handled according to their classification, such as disposal certificates for media, transfer logs for sensitive files or approvals for removal from site. Auditors pick assets from the inventory and ask to see how each was handled. Keep these records linked to the asset register entry so the sample trail is short, and confirm that disposal and removal records are complete for the whole period.

Review and exception records

Dated records of periodic reviews of the policy and procedures, plus any exceptions granted, with approver, reason and expiry. Reviews show the rules still fit the business, and exception logs show that deviations were controlled rather than tolerated. Schedule the review once a year as a calendar item owned by a named person, and record the outcome even when nothing changes.

How the rules, asset inventory, labelling and training fit together

The acceptable use rules under A.5.10 only work when they point at things the organization can actually find. An auditor testing this control will usually start with an asset, then ask whether it appears in the inventory under A.5.9, whether it carries the classification set under A.5.12, whether its label under A.5.13 tells a user how to handle it, and whether the rules for the medium it sits on under A.7.10 were followed. Designing the four controls as one chain lets you answer that walk-through for any sampled asset in minutes rather than days.

A practical way to build the chain is to give each inventory record three fields that your A.5.10 document refers to by name: the asset owner, the classification level and the handling rules that apply at that level. The inventory owns the asset list, the classification scheme defines the levels, and the labelling procedure defines how each level appears on documents, systems and physical media. The acceptable use document then states the handling procedure for each level in plain terms, and cross-references the storage media rules for removable devices, backup media and disposal. Confirm with your own risk owners whether removable media is permitted at each level before you write these cross-references, because the answer changes the procedure users must follow.

Training is where the chain succeeds or fails in daily use. Users need to know the handling rule for a label they see, and the acknowledgement or completion record for the acceptable use rules should be kept with the same identity records you use for access reviews. Open-source learning tools can record who viewed or completed a module, which gives you evidence of communication, but completion tracking alone does not prove that people apply the rules. Sample a few labelled assets each quarter and check that the handling matches the rule, then record the result and any corrective action.

What meeting A.5.10 costs in money and effort

This table breaks down the cost and effort components of meeting A.5.10, marking each as one-time or recurring and naming who is paid for what. Use it to scope internal work, outside help and tooling before requesting quotes, since no price or duration is supplied for any component.

Cost component	One-time or recurring	Who is paid or who spends effort	Drivers and how to keep it down
Policy drafting and approval	One-time, then periodic review	Internal policy owner, legal and management approvers	Number of classification levels and asset types. Reuse one acceptable use rule set with short handling annexes per level.
Engineering to link labels and handling to tools	One-time build, then ongoing changes	Internal platform or IT engineers, or an implementation partner under a written scope	Number of systems that hold information and whether labels can be applied automatically in wikis, document stores and learning platforms.
Tooling and licenses	Recurring where commercial, one-time for setup	Software vendors for proprietary tools, or the organization's own infrastructure for self-hosted open source	Per-user or per-seat licensing for commercial document and learning tools. Self-hosted open-source platforms such as XWiki, BookStack and Moodle remove license fees but keep hosting and support costs. Confirm each license term with the vendor.
Acknowledgement and training effort	Recurring, at onboarding and on policy change	Managers, HR and learning administrators, plus each person who acknowledges the rules	Headcount, turnover and contractor volume. Track completion in the learning platform so acknowledgement evidence is kept in one place.
Evidence upkeep	Recurring	Control owner and asset owners who keep records current	Frequency of asset changes and staff turnover. Version history in wiki tools reduces manual record keeping, but someone still reviews the changes.
External review and auditor sampling	Recurring, at each audit cycle	Independent certification body for the audit. Outside consultants only if the organization buys preparation help	Sample size chosen by the auditor, number of sites and whether the evidence is easy to retrieve. Ask the certification body to explain its sampling approach before the audit.
Internal review and compliance checks	Recurring	Managers and technical compliance staff under A.5.36	Number of teams handling classified information. Automate checks where the tools allow it and keep results for the auditor.

Where A.5.10 implementations usually fail an audit

Auditors rarely fail A.5.10 for missing a document. They fail it when the acceptable use rules were never approved, do not match how information is classified and handled, or cannot be shown to have reached the people they govern. The cards below cover the gaps that come up most often and how to close each one before the assessor arrives.

Rules never approved or reviewed

An acceptable use policy that sits in a shared folder with no owner, approval record or review date is the first thing an assessor questions. Confirm who approves the rules, record that approval with a date and version, and set a review interval the organization can actually keep. Check that the approved version is the one people can find, not a draft from a previous template.

No handling rules per classification level

A.5.10 expects procedures for handling information and other associated assets, not only general statements of good behavior. If the organization classifies information but its handling rules stop at one generic instruction, the auditor will ask what a restricted file must not do that an internal one may do. For each classification level, write the rules for storage, sharing, transfer, printing and disposal, and confirm they match the scheme under A.5.12.

Acknowledgements missing for contractors

Employees often sign acknowledgements at onboarding, while contractors, temporary staff and some service providers never do. Because A.5.10 applies to everyone who uses the organization's information and assets, an unsigned contractor population is a common finding. Ask HR and procurement to name every group with access, collect acknowledgements from each, and record the date and rule version accepted.

Rules not connected to the asset inventory

Acceptable use rules are hard to apply when nobody knows which assets exist or who owns them. Auditors sample the inventory under A.5.9 and ask whether each sampled laptop, server, mailbox or media item falls under a rule and a named owner. Link each asset class in the inventory to the handling rules that apply to it, and test a sample of entries against the rules.

Labelling not referenced in the rules

Handling rules that depend on classification fail when people cannot see the classification. If the acceptable use procedure never mentions labels, the auditor cannot see how a marked document leads to the right handling step. Reference the labelling procedure under A.5.13 directly in the rules, state which labels apply to documents, systems and physical media, and check a sample of labelled items against the handling steps.

No proof that rules reached people

Publishing a policy is not the same as communicating it. Assessors ask how the rules were delivered, who received them, who completed training or quizzes, and what happened to people who did not respond. Keep distribution lists, training completion records and reminder logs in a system that stores timestamps. If the organization uses a learning platform or wiki, confirm that its records show who opened and acknowledged each version.

Questions buyers ask about A.5.10 before hiring outside help

How much effort does A.5.10 take for a small team?

The control itself is a documented rule set plus a procedure for handling information and assets, so the effort is mostly writing, agreeing and communicating it, not building tooling. A small team usually spends its time on three things: deciding how the rules apply to its real working practices (laptops, personal devices, cloud storage, messaging), tying the handling rules to its classification scheme, and collecting proof that people received and accepted the rules. Effort rises with the number of asset types, the number of sites and the number of classification levels that need different handling. Ask any provider to break its estimate into these pieces, and confirm which parts depend on your own inventory and classification work under A.5.9 and A.5.12.

Can a small team implement A.5.10 in-house?

Yes, in most cases a small team can own A.5.10 internally, because the requirement is about clear, communicated rules rather than specialist technology. The in-house team needs someone who understands the organization's information and assets, someone who can write plain procedures, and a manager who will enforce them. Outside help is most useful when the team lacks time to write the rules, when the handling rules must match a customer's or regulator's expectations, or when an assessor is likely to ask for consistency across several related controls. Whichever route you choose, the organization remains accountable for the rules it adopts.

What does A.5.10 need from staff and managers?

A.5.10 needs staff to know the rules, understand how they apply to their daily work, and act on them. Managers need to confirm that their teams handle information according to the classification level, and to report exceptions. In practice this means:

Briefings or short training on acceptable use and handling at each classification level
Acknowledgements that staff have read and accepted the rules, recorded with dates
Managers checking handling during routine reviews and raising problems promptly
A clear route for asking questions and reporting misuse or accidental exposure

Auditors often test this by asking a sample of people what they do with a sensitive file, so the rules must be understood, not just filed.

How long does it take to be ready for an audit on A.5.10?

Readiness depends mainly on whether the rules, classification scheme and asset inventory already exist and whether staff have been told about them. If those foundations are in place, the remaining work is documenting the rules, communicating them and collecting acknowledgements, which can be done in a short period. If classification, inventory or training do not exist yet, those dependencies add work and should be scheduled first. Ask any provider for a written plan that lists the dependencies and states which ones you must complete yourself, and confirm the timeline against the certification body's audit schedule rather than a generic estimate.

Can an implementation partner write the acceptable use rules for us?

An implementation partner can draft the rules, procedures and handling tables, and can align them with your existing policies and classification levels. The organization must approve the rules, own them, and adopt them as its own, because the rules must reflect how your business actually works and who is accountable for them. Expect the partner to ask about your systems, data types, contractual obligations and staff practices before drafting anything. Confirm in writing who reviews the draft, who approves it, and how revisions are handled after the engagement ends.

What can a partner not do for the auditor?

A partner cannot perform the audit, judge whether your controls conform, or issue a certificate. Only an independent certification body or auditor can do that, and the certification body must be accredited for the work. A partner can prepare the rules, collect evidence, run a readiness review and explain what the auditor will ask for. The partner should not sit in the audit as the decision-maker, and the certification body should be independent of the partner that helped you prepare. Ask for a clear written statement of the partner's role so that no one assumes the partner has certified anything.

How do we keep A.5.10 evidence current after the engagement ends?

Keep evidence current by building it into routine work rather than collecting it once before an audit. The usual approach is to store the approved rules in a version-controlled location, schedule periodic review, and record each staff acknowledgement with its date. Self-hosted tools can help: a wiki such as XWiki keeps version history showing what changed, when and by whom, and BookStack can restrict who may edit handling procedures through role-based permissions. A learning platform such as Moodle can track training completion for staff acknowledgements. Confirm with your own environment which tools you already run and which evidence each one can export.

How DeployOpen prepares A.5.10 rules and evidence in your environment

DeployOpen plans and builds the systems that hold A.5.10 rules, handling procedures and their evidence inside your own infrastructure. We prepare the documents, the acknowledgement records and the access trail so your organization can own its control and show it to an independent auditor, who alone issues any report or certificate.

How we scope

Agree in writing which asset types, classification levels and user groups the A.5.10 rules will cover.
Confirm which self-hosted platforms will hold the acceptable use policy, handling procedures and acknowledgements.
Name the owners who approve the rules and who must read and accept them before work starts.

How we build

Set up versioned document spaces so every change to a handling rule records what changed, when and by whom.
Configure role-based permissions so only approved editors can publish or alter acceptable use procedures.
Build learning paths that record each user's acknowledgement and completion of the rules by audience.

How we hand over

Deliver the documented rules, handling procedures and their version history in a form your auditor can sample.
Provide a written map linking each rule to the platform where its evidence is kept and who reviews it.
Walk your compliance and security teams through the evidence trail so they can run reviews without us.

How we support

Offer ongoing support and upgrades for the platforms as a retainer, if your organization wants them.
Update handling procedures when classification levels, systems or legal requirements change, under agreed scope.
Confirm with your certification body which evidence format and sampling approach it expects before fieldwork.