Which standards require an information transfer policy?

ISO/IEC 27001:2022: 5.14; ISO/IEC 27701:2025: A.3.7.

What must an information transfer policy contain under ISO 27001?

5.14: Put rules, procedures or agreements in place for every way information moves, inside and outside the organization. The ISO 27002 guidance beside 5.14: Requires transfer rules, procedures or agreements to be in place for every type of transfer facility, covering transfers within the organisation and between the organisation and outside parties.

Who should own the information transfer policy?

The clauses imply the information security lead (CISO or ISMS manager). The register names the role so the line on your list can carry a name.

How often should an information transfer policy be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for an information transfer policy?

No template yet; the page names what the clauses expect the document to contain, which is the outline to start from.

Every policy type · Assets, data and classification

Information transfer policy

How information moves between people, systems and organisations, by which channels, with which protections, and under which agreements.

How the register reads it

Also called	data exchange policy, secure file transfer
Family	Assets, data and classification
Document type	Policy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds into	The regimes accept it folded into the information classification and handling policy; when neither is listed, the gap is counted once, under the parent.
Expected owner	The information security lead (CISO or ISMS manager).
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	ISO 27001 is ticked and no line resolves to it or to its parent (ISO 27701 requires it too, inside a parent document, so it does not list it separately).
Template	No template yet. The clauses below say what the document is expected to contain.

Which standards require it, and what each expects it to contain

2 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 5.14 Information transfer

Put rules, procedures or agreements in place for every way information moves, inside and outside the organization.

What the ISO 27002 guidance expects the document to say: Requires transfer rules, procedures or agreements to be in place for every type of transfer facility, covering transfers within the organisation and between the organisation and outside parties.

Evidence an auditor accepts: Transfer rules covering each transfer type in use, being electronic, physical and verbal; transfer agreements with external parties, setting out protection, liability and traceability requirements; technical evidence of protection in transit, such as enforced transport encryption, secure file transfer configuration and managed file transfer logs
Common gap: Reliance on informal verbal agreements
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO/IEC 27701:2025

ISO 27701 A.3.7 Information transfer

The organization's information transfer rules and procedures shall ensure that the rules related to the processing of PII are enforced throughout and, where applicable, outside the system, and where physical media is used to transfer PII a system shall record incoming and outgoing media including the type of media, the authorised sender and recipients, the date and time and the number of media, with additional measures such as encryption where possible so that the PII can be accessed only at the destination; physical media carrying PII shall be subject to an authorisation procedure before leaving the premises and kept inaccessible to anyone but authorised personnel.

Evidence an auditor accepts: Transfer procedures applying the PII processing rules to every transfer channel; log of physical media containing PII sent and received with the fields the standard names; authorisation records for media leaving the premises
Common gap: Transfer rules enforced inside the system but not on exports and extracts
Source: ISO/IEC 27701:2025

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Information classification and handling policy · Media handling and disposal policy