A.5.14 Organizational
Information transfer
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (14)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- AC-17mostlyaligns with — Both controls establish rules, authentication, and protective measures for information exchanged over external or remote connections.
- AC-21mostlyaligns with — Both controls require agreements and controls that govern how and with whom sensitive information may be shared or transferred.
- MP-5mostlyaligns with — Both controls mandate accountability, chain-of-custody, and protection measures when physical media containing information are transported.
- SC-8mostlyaligns with — Both controls require cryptographic and procedural safeguards to protect information confidentiality and integrity while it moves between systems or organizations.
- AU-10partialaligns with — Both controls emphasize non-repudiation and traceability to ensure accountability for information while it is in transit.
- CA-3partialaligns with — Both controls require formal agreements that define security responsibilities and protections when information is exchanged with external parties.
- SC-7partialaligns with — Both controls apply boundary and flow protections to prevent unauthorized interception or misrouting of information leaving organizational control.
Aligned NIST CSF 2.0 outcomes (13)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- GV.SC-05mostlyaligns with — Mandating transfer agreements with third parties that define responsibilities, liabilities, and protection measures fulfills the CSF outcome of integrating cybersecurity requirements into supplier and partner contracts.
- PR.DS-02mostlycovers — The ISO control's rules and agreements for protecting information during electronic, physical, and verbal transfer directly implement the CSF outcome of safeguarding data-in-transit confidentiality, integrity, and availability.
- PR.IR-01mostlyaligns with — By requiring controls against interception, misrouting, and unauthorized access during transfer, the ISO guidance achieves the CSF outcome of protecting networks and environments from unauthorized logical access and usage.
- ID.RA-07partialaligns with — By requiring consideration of legal, regulatory, and contractual obligations when transferring information, the ISO control aligns with the CSF outcome of assessing and recording risk impacts from changes and exceptions.
- PR.AA-05partialaligns with — The control's requirement for recipient authentication and access controls commensurate with information classification supports the CSF outcome of defining, managing, and enforcing access permissions and authorizations.
- PR.PS-04partialaligns with — The control's emphasis on traceability, non-repudiation, and chain-of-custody records during transfer supports the CSF outcome of generating and making log records available for continuous monitoring.
Related OWASP ASVS 5.0 requirements (12)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V12.2.1mostlyaligns with — The ISO requirement for protecting electronic information transfers over public networks with stronger authentication and encryption directly supports the ASVS mandate that TLS must be used for all external-facing HTTP services without fallback to insecure protocols.
- V12.3.1mostlyaligns with — Mandating encrypted protocols such as TLS for all inbound and outbound connections between application components mirrors the ISO expectation that cryptographic controls protect information in transit between the organization and third parties.
- V13.2.4partialaligns with — The ISO rule requiring an allowlist of approved external services for information transfer aligns with the ASVS requirement that the application only communicates with explicitly permitted external resources or systems.
- V13.2.5partialaligns with — ISO guidance that servers must be configured with an allowlist of destinations they may send requests to corresponds to the ASVS control that restricts the web or application server to an approved list of outbound targets.
- V14.2.3partialaligns with — The ISO prohibition on sending sensitive information to untrusted external parties or services aligns with the ASVS requirement that sensitive data must not be transmitted to untrusted third parties such as trackers.
- V4.1.4partialaligns with — ISO rules that restrict electronic communication facilities and prevent automatic forwarding of messages map to the ASVS requirement that only explicitly supported HTTP methods may be used by the application.
Related weaknesses / CWE (29)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-200mostlyprevents — Requiring encryption, access controls, and recipient authentication for transfers directly reduces the chance that sensitive data reaches an unauthorized observer.
- CWE-1323partialprevents — Rules for secure transfer reduce exposure when trace data leaves the SoC.
- CWE-201partialmitigates — Information-transfer rules directly govern what data may be sent to external parties.
- CWE-212partialprevents — Information-transfer rules can require sanitization of sensitive content before sharing.
- CWE-213partialmitigates — Transfer rules can enforce consistent protection when data crosses stakeholder boundaries.
- CWE-300partialprevents — Information transfer policies address secure exchange but are high-level and not technical.
- CWE-311partialprevents — Explicit rules requiring encryption for sensitive information in transit eliminate the weakness of sending data without cryptographic protection.
- CWE-319partialprevents — Mandating cryptographic protection and stronger authentication on public networks stops the transmission of plaintext sensitive information.
- CWE-359partialmitigates — Labeling, chain-of-custody, and access-control requirements limit the exposure of private personal information during any transfer method.
- CWE-402partialmitigates — Information-transfer rules can prevent unintended disclosure of private resources outside the product.
- CWE-5partialprevents — Requires secure transfer procedures that would mandate encryption for sensitive data in transit.
- CWE-523partialprevents — Requires secure information transfer, which can include protecting credentials in transit.
- CWE-924partialprevents — Requires secure information transfer procedures that can include integrity checks.
- CWE-1230nonemitigates — Transfer policies can require stripping or protecting metadata, but coverage is indirect.
- CWE-284nonenone — Transfer agreements that tie access rights to information classification enforce proper access control before any data leaves the organization.
- CWE-313nonenone — Transfer policies can require encryption, indirectly reducing cleartext storage risk.
- CWE-532nonenone — Retention, disposal, and labeling rules reduce the likelihood that sensitive data ends up in logs or other externally accessible artifacts created during transfer.
- CWE-669nonemitigates — Information-transfer rules can prevent improper resource hand-off between spheres.
Mitigated MITRE ATT&CK techniques (6)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1040partialmitigates — Requiring cryptographic protection and stronger authentication for transfers over public networks directly reduces the value an adversary gains from passive network sniffing of sensitive data in transit.
- T1557partialmitigates — Mandating recipient authentication and cryptographic controls for information in transit limits an adversary’s ability to perform on-path interception or relay attacks against the transfer channel.
- T1567partialmitigates — Requiring approval and policy controls before using external cloud or file-sharing services limits an adversary’s ability to exfiltrate data to attacker-controlled web services without triggering procedural violations.
- T1021nonemitigates — Transfer agreements that enforce authentication and access controls for third-party recipients restrict an adversary’s ability to abuse remote services or shares to move laterally using stolen or misused credentials.
- T1078nonemitigates — Requiring explicit recipient authentication and chain-of-custody procedures for transferred information makes it harder for an adversary to leverage compromised valid accounts to exfiltrate or move data without detection.
- T1114nonemitigates — Rules that restrict automatic forwarding and require approval for external messaging reduce the likelihood that an adversary can silently collect or redirect email without authorization.
Prevented OWASP Web Top 10 (2025) risks (4)
OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- A04partialprevents — Mandating cryptographic techniques and stronger authentication for transfers over public networks directly stops exposure of sensitive data in transit.
- A08partialmitigates — Traceability, non-repudiation, and chain-of-custody requirements make it harder for an attacker to tamper with data or media without detection.
- A01noneprevents — Requiring recipient authentication, access controls, and chain-of-custody procedures stops unauthorized parties from obtaining or altering information during transfer.
- A02noneprevents — Explicit rules for electronic transfer, malware protection, and approved services reduce the chance that transfer mechanisms are left in an insecure default state.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.