Self-hosted file sharing for ISO 27001

How self-hosted file sharing supports ISO 27001 controls 5.14 and 5.23

An ISMS owner who runs file sharing with staff and partners on Nextcloud can meet the intent of Annex A control 5.14 *Information transfer* and control 5.23 *Information security for use of cloud services* of ISO/IEC 27001:2022, but only when transfer rules, procedures and evidence are written down and operated around the platform. The software does not satisfy either control on its own. Control 5.14 asks for transfer rules or agreements covering every transfer facility, both inside the organization and with other parties, so the Nextcloud configuration has to be described as one of those facilities. Control 5.23 asks for defined processes for acquiring, using, managing and exiting a cloud service, which for a self-hosted deployment means documenting who runs the servers, where the data sits, and how data leaves the platform at the end.

Be precise about who certifies what. ISO does not certify organizations. Accredited certification bodies assess the ISMS against ISO/IEC 27001:2022, and they work to ISO/IEC 17021-1 and ISO/IEC 27006-1 when they do so. DeployOpen plans, configures and documents the self-hosted platform and prepares the control descriptions, configuration records and operating evidence that an auditor will ask for. DeployOpen does not issue audit reports, attestations or certificates. Before scoping work, confirm with your certification body which evidence it expects for each control and whether the deployment falls inside the ISMS scope, because that decision determines which Nextcloud settings, logs and procedures need to be in the evidence set.

Start with three decisions. First, define the external sharing rules in writing: who may create public links, whether links require passwords and expiry dates, which guest accounts are allowed, and how sharing is restricted by classification under control 5.12. Second, decide how cloud-service responsibilities are split between your team and the implementation partner, and record the exit path for data, including how exports and deletion are verified. Third, decide how long activity logs and share records are kept and who reviews them. Ask the partner to show the configuration baseline, the change record for each upgrade (Nextcloud does not allow skipping major releases), and a sample of audit log entries tied to a share. Those artifacts, not the product name, are what an assessor reviews.

Mapping A.5.14 and A.5.23 requirements to Nextcloud configuration

This table maps the ISO/IEC 27001:2022 Annex A controls most often raised for file sharing to specific Nextcloud settings and the evidence an assessor will ask for. Read each row as a requirement, the work the organization must do, and the configuration that supports it, then confirm the settings against your own version and policy. The main takeaway is that Nextcloud can support these controls, but the rules, owners and records must exist outside the software.

Requirement	What the function must do	How to configure Nextcloud
A.5.14 Information transfer rules and procedures	Define which transfer channels are approved for internal and external file exchange, and who may use each one.	Set a written sharing policy, then restrict public link creation and enforce link expiry, passwords and download limits in the sharing settings of the admin panel.
A.5.14 Agreements with external parties	Hold a documented agreement or confidentiality terms before a partner or client receives files, and record who holds access.	Create guest accounts only for named external parties, tie each guest to a sharing agreement reference in folder naming or tags, and review guest lists on a set schedule.
A.5.14 Controls on transfer to untrusted networks	Decide where external access is permitted and block or limit it when the network is not trusted.	Use access control rules to restrict sharing or downloads by network or group, and confirm how these rules apply to sync clients and the web interface.
A.5.23 Acquisition and onboarding of the cloud or hosting service	Assess the hosting model, edition and support terms before adopting the platform, and record the decision.	Document the edition, version and hosting boundary, then confirm the supported major version and maintenance terms with the vendor before go-live.
A.5.23 Use and management of the service	Assign administrators, review privileged access, track upgrades and keep the service within the approved scope.	Limit admin roles to named staff, enable audit logging for admin and sharing events, and schedule upgrades one major version at a time with a backup before each.
A.5.23 Exit from the service	Define how data, accounts and shares are returned, migrated or deleted when the service or a user relationship ends.	Set a documented offboarding runbook covering account disablement, share revocation, export of files and verified deletion from trash and versions.
A.5.12 Classification of information	Label information by sensitivity so transfer and retention rules can apply to each class.	Create system tags for classes such as public, internal and confidential, and use them in group folder rules or sharing restrictions where your version supports them.
A.5.10 Acceptable use of information	Tell users which data may be shared externally and through which methods, and confirm they accept the rules.	Show the acceptable use terms in a login banner or user guide, and pair them with group-based sharing limits for roles that handle restricted data.
A.6.6 Confidentiality or non-disclosure agreements	Require signed confidentiality terms for external users who can access shared content.	Gate guest onboarding behind a documented NDA step, and record the agreement date in the account or group naming convention.
A.8.24 Use of cryptography	Protect data in transit and at rest with approved methods, and define who controls the keys.	Enforce HTTPS on the web and sync endpoints, and decide between server-side encryption and end-to-end encrypted folders based on who must not read the data.

Why external sharing links are the first thing auditors test

Auditors test external sharing first because A.5.14 Information transfer merges three controls from the 2013 edition: information transfer policies and procedures, agreements on information transfer, and electronic messaging. That merger means one assessment question covers three things at once: the written rule, the agreement that governs the exchange, and the channel the data actually moves through. A Nextcloud instance with public links enabled gives an auditor all three to inspect. Confirm which of these your organization can show for every external share: the policy that defines who may receive files, the agreement or terms that apply to that recipient, and the audit record of the transfer itself.

Each public link, guest account or expiring share is a transfer event that must be governed, not just a convenience setting. In Nextcloud, the administrator decides whether public link creation is allowed, whether passwords and expiry dates are enforced, and whether guests can re-share. Those settings, along with the group that may create external shares, are the configuration an auditor will ask to see. Plan a recurring check that exports the list of active shares, confirms each has an owner and an expiry, and reconciles guest accounts against current contracts. Where a share has no business owner, treat it as an open finding rather than a backlog item.

The control set itself changed when ISO/IEC 27001:2022 replaced the 2013 edition. Under IAF MD 26:2023, certificates to the 2013 edition had to expire or be withdrawn by 31 October 2025, the end of the 36-month transition period, so an organization still citing 2013 control numbers in its statement of applicability will be assessed against the 2022 structure. Map your existing transfer procedures to the 2022 control titles and attributes before the first assessment cycle begins, and confirm with your certification body which edition and transition arrangements apply to your scope.

Which Nextcloud deployment fits an ISMS scope

The community edition is the Nextcloud Server code licensed under AGPL-3.0, installed and run by your own team on infrastructure you control. Your organization owns every maintenance decision, from choosing which release to deploy to testing app compatibility. For an ISMS, this means the vulnerability management, change control and patching records under Annex A controls such as A.5.23 (cloud service use) must come from your own tickets, change logs and change windows, not from a vendor.

Patch ownership: Your team tracks the monthly maintenance releases that Nextcloud publishes for each supported major version and applies them within your own change process.
Upgrade ownership: Your team plans every major upgrade, which must move one major version at a time, with a backup taken before each step and third-party apps disabled until confirmed compatible.
Evidence source: Maintenance evidence is what you generate yourself: change records, release notes reviewed, test results and backup restore logs.
Skills requirement: You need in-house or contracted staff who can run PHP, the database, the web server and the backup chain, and who can roll back a failed upgrade.
Lifecycle risk: Nextcloud 35 was released on 16 September 2026 with end of life in September 2027, so the upgrade calendar is a recurring obligation.

Confirm with your auditor how they will accept self-generated maintenance records as evidence for the controls in scope.

Open-source platforms that fit this control set

The controls for information transfer and cloud service use are met by a small set of components: a sharing platform, an editor, a file sync alternative, and the scanning and backup services that surround them. The cards below cover the platforms most often considered and what to confirm before selecting each one.

Nextcloud Server

Nextcloud Server is the sharing core for this control set. Its link shares, expiry dates, passwords, versioning and trash bin give you the transfer records an assessor will ask to see. Licensed under AGPL-3.0, so confirm your obligations if you modify the code and offer it to users over a network. Authentication can come from LDAP and Active Directory, OpenID Connect or SAML, so confirm which backend your identity provider supports before you design the admin model.

Seafile

Seafile is a file sync and share alternative to Nextcloud, under GPLv2 with an additional permission to link with OpenSSL. It suits teams that want a simpler sync model and a narrower feature set. Before selecting it for A.5.14 transfer controls, confirm which external sharing controls, audit logging and retention features exist in the edition you plan to run, and how they compare with your rules for expiring links and guest access.

ONLYOFFICE Docs

ONLYOFFICE Docs lets staff edit Office Open XML documents, spreadsheets and presentations in the browser, so controlled documents can stay on your servers instead of leaving through email attachments. It supports this control set by reducing copies sent outside the sharing platform. The product is licensed under AGPL-3.0, so confirm the license obligations for your deployment and check how the editor integrates with your Nextcloud version before you commit to a release.

Collabora Online

Collabora Online is the alternative browser editor, released under the Mozilla Public License 2.0. It fits organizations whose licensing review favors a file-level copyleft license over AGPL-3.0. Test editing of your actual templates and macros before selecting it, because format fidelity differs between editors. Confirm which Nextcloud integration path your version supports and who supplies support for the editor component.

Nextcloud All-in-One

Nextcloud All-in-One is the official installation method and bundles components that map to specific controls: ClamAV for antivirus scanning of uploads, BorgBackup for backups kept outside the sync path, and full-text search. Use it to standardize the deployment and document the components in your asset inventory. Confirm that the bundled services meet your own scanning, backup retention and encryption requirements, and plan how you will keep the bundle updated.

How to sequence the ISMS work before go-live

The sequence turns the Nextcloud rollout into an information security management system that an auditor can trace from scope to evidence, so each control decision is written down before users depend on it. Each step closes with a record that the next step relies on.

Confirm ISMS scope and transferable information classes
Start by defining which business units, users, data stores and external parties fall inside the ISMS scope, since the file sharing platform must sit within that boundary. Then list the information classes that may leave the organization through a share link, guest account or sync client, and the classes that may not. Information owners and the information security lead sign off on this list. Done means a signed scope statement and a classification table that names each permitted and prohibited class for external transfer.
Write transfer rules and the sharing procedure
Using the classification table, write the information transfer rules and the step-by-step procedure for internal and external sharing, covering who may create external links, which recipients are allowed, and how guests are approved. Where a partner or client needs a formal agreement before exchanging files, draft that agreement reference into the procedure. Legal and the information security lead approve the document. Done means an approved transfer procedure with named owners and a version number that staff can access.
Define cloud service acquisition and exit criteria
Because the platform is self-hosted, the cloud service questions shift to the hosting provider, any managed service partner and any SaaS components such as office editing or external identity. Document how each is acquired, what security requirements it must meet, how its use is managed, and how data is returned and removed at exit. Confirm these terms with each provider in writing. Done means a cloud service register with acquisition criteria, review dates and a tested exit procedure, which supports the evidence expected under A.5.23.
Configure the sharing policy in Nextcloud
Translate the approved rules into Nextcloud settings: restrict link sharing by group, require passwords and expiry on external links where the procedure says so, limit guest accounts to approved groups, and set retention for versions and the trash bin. Export the configuration and keep it under change control so that each setting traces to a rule. The administrator and the security lead review the export against the procedure. Done means a dated configuration baseline that matches the written rules, with any deviation recorded and approved.
Test sharing scenarios and record the results
Run written test cases for each rule: an internal share, an external link with and without password, a guest account accessing only its folder, an expired link, a blocked classification and a removed user. Capture the outcome of each case with a screenshot or log extract and the name of the tester. Where a test fails, log a corrective action and retest before continuing. Done means a test record in which every rule has a passing result or an approved exception, linked to the configuration baseline.
Review audit logs and retention evidence
Confirm that sharing events, login events and administrative changes are written to logs that are protected from ordinary users and retained for the period the policy sets. Pull a sample of logged external shares and check each one against the transfer procedure and an approved recipient. Record any gap and its owner. Done means a log review report with sampled evidence and a retention statement that the auditor can reproduce.
Run an internal audit before the certification visit
Have an internal auditor who did not build the platform check the ISMS against the scope, rules, configuration baseline, tests, logs and cloud service register. Findings are raised in writing, assigned owners and closed with evidence before the external visit. Management reviews the results and records decisions. Done means an internal audit report, closed or accepted findings, and a management review record, which together show the certification body a working management system rather than a set of documents.

Evidence auditors ask for and which component produces it

This table maps each piece of evidence an assessor is likely to request to the Annex A control it supports, the Nextcloud or surrounding component that produces it, and the team that should own it. Use it to plan evidence collection before the audit, not during it. The main takeaway is that most evidence comes from configuration exports and logs, so retention and ownership must be decided before the first audit cycle begins.

Evidence item	Control it supports	Producing component	Owner
Information transfer rules and procedure document	A.5.14 Information transfer	Written policy and procedure, referencing Nextcloud sharing settings	Information security lead
External sharing policy export	A.5.14 Information transfer, A.5.10 Acceptable use	Nextcloud admin settings export of sharing rules and defaults	Platform administrator
Share link configuration settings export	A.5.14 Information transfer, A.8.24 Use of cryptography	Nextcloud sharing configuration, with screenshots dated to the review	Platform administrator
Guest account register and access reviews	A.5.19 Supplier relationships, A.5.14 Information transfer	Nextcloud user and guest list, plus signed review records	Data owners with IT access management
Audit log samples of external shares	A.5.14 Information transfer, A.5.23 Cloud services use	Nextcloud audit log app output for share creation and access events	Security operations
Retention and trash configuration	A.5.23 Cloud services use, A.5.12 Classification of information	Nextcloud version retention and trash bin settings, plus retention policy	Records or compliance lead
Classification labels in use	A.5.12 Classification of information	Nextcloud metadata or tag labels applied to files, with the label scheme	Data owners
Backup and restore test records	A.5.23 Cloud services use, A.5.30 ICT readiness for business continuity	Backup tool job logs and documented restore test results	Infrastructure operations
Nextcloud version and patch history	A.5.23 Cloud services use, A.8.8 Management of technical vulnerabilities	Upgrade records and the Nextcloud release schedule as applied	Platform administrator
Supplier or hosting agreements for cloud services in scope	A.5.19 Supplier relationships, A.5.20 Supplier agreements, A.5.23 Cloud services use	Signed contracts, support subscription terms and hosting provider agreements	Procurement and legal

What Nextcloud configuration alone does not satisfy

Nextcloud can enforce link expiry, passwords, download limits and audit logging, but the ISO 27001:2022 controls on transfer, classification, cloud exit and supplier oversight are satisfied by written rules, trained people and retained evidence. The cards below list the gaps auditors most often find when a file platform is treated as the control itself. Tooling supports each of these controls, but the policy, people and records must exist.

No written transfer agreements with partners

A.5.14 expects rules, procedures or agreements covering information transfer with other parties. A Nextcloud guest share with a supplier is only controlled if a signed agreement defines what may be shared, who approves guest accounts, how long access lasts and what the partner must do with files afterward. Check that each external sharing relationship maps to a written agreement and that the share settings in Nextcloud match those terms.

No classification scheme people apply

A.5.12 requires information to be classified according to needs for confidentiality, integrity and availability, and A.5.14 depends on that classification to decide what can leave the organization. Folder names and tags do not make a scheme. Confirm that the labels are defined in a policy, that users know which label applies to which content, and that sharing restrictions on each label are documented and tested.

No cloud exit plan

A.5.23 asks for processes covering acquisition, use, management and exit from cloud services. A self-hosted Nextcloud may run in a cloud account the organization rents, so exit still applies. Document how data would be exported from the database, file store and object storage, how users would be moved, and how the platform would be shut down and its storage sanitized. Test the export path at least once.

No supplier review cadence

A.5.19 to A.5.22 cover supplier relationships, agreements, supply chain risk and ongoing monitoring. Nextcloud, its hosting provider, any implementation partner and object storage vendors are all suppliers. Set a review schedule that checks support status, release and maintenance dates, contract terms and incident notices, and record each review. A missed review is a common finding even when the platform itself is well configured.

No staff acceptable use training

A.5.10 expects rules on acceptable use of information and associated assets to be defined, communicated and followed. Staff decide daily whether to send a link publicly, forward a folder to a personal address or sync files to an unmanaged laptop. Those decisions need a short acceptable use standard, a record that each person received it, and periodic reminders tied to the classification scheme.

No evidence of management review

The ISMS needs proof that leadership reviews the controls, risks and exceptions for file sharing at planned intervals. Export a list of active external shares, expired links, disabled guests and open exceptions, then record the review, decisions and owners. Without these minutes and records, a certification body has nothing to sample, even if the Nextcloud logs are complete.

What do buyers ask before hiring help for ISO 27001 file sharing?

How much effort does ISO 27001 file sharing work take, and what drives it?

The effort depends on how much the scope covers, and no single figure applies across organizations. The main drivers are the number of users and external partners who receive links, how many systems the sharing platform connects to (directory, single sign-on, data loss prevention, backup, logging), how many classification levels the policy must support, and how mature the existing information security management system already is. An organization with a documented information transfer rule and a classification scheme needs less mapping work than one starting from nothing. Ask any partner to show how each driver changes the work package in the written scope before you accept a quote.

Can our own team set up ISO 27001 file sharing without outside help?

A skilled administrator with a clear scope can install and configure Nextcloud, set external share rules, expiry, password requirements and retention, and turn on logging. The harder part is the management system around the platform: writing the transfer rules and procedures that control A.5.14, deciding how cloud service use is approved, monitored and exited under A.5.23, and keeping evidence that these controls operate over time. That work needs a named owner who controls the ISMS and can make decisions about risk. If that owner is not in place, the technical build will be sound but the audit trail will be thin. Partners can help with both halves, but the ownership must stay with your organization.

How long does an ISO 27001 file sharing engagement take?

The timeline follows from the written scope, not from a fixed number of weeks. A scope that covers one tenant, a single directory, and a short list of external sharing use cases differs greatly from one that adds migration from cloud drives, multiple sites, and a full evidence pack. Before work starts, ask for the phases, the dependencies on your team (for example, directory access and change approvals), and the points where you must sign off. Most engagements are fixed-scope, so the agreed deliverables and dates should be recorded in writing. Be cautious of any partner that gives a duration before reviewing your environment.

What does the work need from our team during the engagement?

The work needs four things from your side. First, scope decisions, such as which groups may create external links, which partners are guests, and which data types are excluded from external sharing. Second, classification input, meaning the labels your organization already uses or the ones it approves for file handling. Third, access to the target environment, including test and production instances, the identity provider, logging and backup systems, through your change process. Fourth, a named owner who approves policy wording, accepts residual risk and signs off evidence. Without these inputs, the partner will have to make policy decisions on your behalf, which the standard expects your organization to make.

Does a Nextcloud Enterprise subscription change the ISO 27001 picture?

A subscription can change the maintenance evidence, but it does not by itself satisfy any Annex A control. Nextcloud sells Standard, Premium and Ultimate tiers with a 100-user minimum, and the pricing page describes differences in maintenance length, support hours and response times. A longer maintenance lifecycle and faster support can make it easier to show that security updates are applied in time, which supports the cloud service management work under A.5.23. Confirm the current tier details, minimums and terms on the Nextcloud pricing page, and check how the chosen tier fits your vendor review and supplier monitoring records. Your evidence still has to show your own operation of the platform.

Will DeployOpen certify our ISO 27001 file sharing setup?

No. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. ISO does not certify organizations, and accredited certification bodies perform the assessment against ISO/IEC 27001:2022 under their own accreditation rules. DeployOpen's role is to configure the Nextcloud platform, document the controls it supports and organize the evidence your certification body will ask to see. Before you engage a certification body, confirm its accreditation status through the IAF CertSearch database and agree with it, in writing, which evidence it expects from the platform.

Which questions should we ask a partner before signing a scope?

Ask how the partner will map each external sharing rule to A.5.14 and each cloud service decision to A.5.23, and which documents it will hand over. Ask what the scope excludes, such as ongoing policy ownership, user onboarding, or certification support. Ask how it will handle upgrades, since Nextcloud requires upgrading one major version at a time with a backup before each step. Ask who is accountable for the evidence after handover. Finally, ask for the written deliverables, acceptance criteria and the support model. A clear answer to each point makes the quote comparable with others and reduces surprises during the rollout.

How DeployOpen fits into an existing ISMS

DeployOpen fits into your information security management system as the implementation and evidence partner, not as the owner of the ISMS. Your organization keeps ownership of the policies, risk assessment, statement of applicability and the decisions about which Annex A controls apply to the file sharing service. Before work starts, DeployOpen agrees the scope in writing: the Nextcloud deployment, the supporting components such as the database, object storage, backup target and identity connection, and the controls that each deliverable is meant to support. Because most engagements are fixed-scope, the written scope is also the reference point when you later ask what was delivered and what remains your responsibility.

Inside your infrastructure, DeployOpen configures Nextcloud and its supporting tools to the settings your information transfer rules and cloud service requirements call for. That work covers external sharing policy, link expiry, password requirements, classification and retention settings, audit logging and the transfer paths that Annex A control 5.14 and control 5.23 describe. DeployOpen can also run security testing against the sharing path, including the web interface, APIs and any integrations, and hand over the findings so your team can track remediation. DeployOpen prepares the systems, configuration records and evidence for the assessment, but it does not issue audit reports or certificates.

The certification body and its auditors decide conformity. An accredited certification body issues the certificate after its audit, and ISO does not certify organizations itself. Confirm with your certification body which evidence formats it accepts, how it samples logs and configuration exports, and whether it expects evidence from the implementation partner to be retained by you. Keep the division of labor explicit in your ISMS documentation: you own the control decisions and the risk acceptance, DeployOpen supplies implementation and evidence artifacts, and the auditor reaches its own findings.

How DeployOpen works on this

DeployOpen starts by agreeing in writing which external sharing, retention and classification controls the Nextcloud deployment must evidence for the ISMS. We then implement those settings inside your own infrastructure and document how each one maps to the relevant Annex A controls, so your team and your certification body can follow the trail.

How we scope

Confirm which Annex A controls and internal policies the file sharing scope must evidence, starting with information transfer and cloud service use.
Inventory current external sharing paths, cloud drives and file servers that hold in-scope information, with owners for each.
Agree the written scope, deliverables and timeline before work starts, since most engagements are fixed-scope.

How we build

Configure Nextcloud external share rules, link expiry, password requirements and download restrictions to match the approved transfer policy.
Set classification labels and retention rules for shared folders, then test that restricted content cannot leave through public links.
Test sharing controls, audit logging and backup restores against the documented requirements before the platform goes live.

How we hand over

Deliver a control mapping that links each sharing, retention and classification setting to the ISO 27001 control it supports.
Document configuration, administrator runbooks and the procedure for approving new external sharing or changing retention periods.
Hand over evidence samples, such as share audit reports and access reviews, that your internal auditors and certification body can request.

How we support

Ongoing support, upgrades and continuous security testing are available as retainers after the initial handover.
Plan one major Nextcloud version at a time, with a backup before each upgrade and third-party apps checked for compatibility first.
Review the control mapping after each audit cycle or material change so the evidence stays current for your certification body.