ISO 27001 Annex A 5.32: Intellectual property rights

What auditors look for

Auditors check that 5.32 is either justified as not applicable in your Statement of Applicability or implemented and working. Typical evidence includes:

• Software licence inventory
• Rules on use of third-party content
• Open source licence review

How to implement 5.32 in practice

1. Track SaaS and software licences centrally
2. Check open source licences in products
3. Include AI-generated content rules
4. Name an owner for 5.32, decide how often it runs and file evidence each time, so the control is audit-ready all year.

Recording 5.32 in the Statement of Applicability

List 5.32 with whether it applies, the reason (usually the risks it treats or a legal or contractual requirement), its implementation status and where the evidence lives. If you exclude it, explain why none of your risks or obligations require it.

Free resources

• ISO 27001 and GDPR readiness assessment
• 10 steps to implement ISO 27001
• Remote ISO 27001 consultant

More organizational controls

• 5.28 Collection of evidence
• 5.29 Information security during disruption
• 5.30 ICT readiness for business continuity
• 5.31 Legal, statutory, regulatory and contractual requirements
• 5.33 Protection of records
• 5.34 Privacy and protection of PII
• 5.35 Independent review of information security
• 5.36 Compliance with policies, rules and standards for information security