In short
ISO 27001 control 5.14 (information transfer) requires organisations to have rules, procedures or agreements for every way information is transferred: electronically, on physical media and verbally, both internally and with external parties. For secure file sharing, that means an auditor wants to see more than a policy. They want evidence that it works in practice. In the Netherlands, the BIO2 applies this control to the entire public sector.
This article explains what control 5.14 asks of file sharing, which evidence an auditor expects, how the Dutch BIO2 builds on it, and how to set it up in five steps.
What is ISO 27001 control 5.14?
Control 5.14 is listed in Annex A of ISO 27001, the standard you get certified against. ISO 27002 is the accompanying guidance and explains how to implement the control.
Control 5.14 in ISO 27001:2022 requires an organisation to have rules, procedures or agreements for all types of information transfer, within the organisation and with other parties. The goal is to keep information confidential, intact and available while it is being transferred.
The control covers three types of transfer:
- Electronic: email, file sharing, portals, API integrations and messaging apps.
- Physical media: USB drives, external disks and paper files.
- Verbal: phone calls, meetings and video calls.
In ISO 27001:2013 these were three separate controls (A.13.2.1 to A.13.2.3). The 2022 version merged them into one.
Why file sharing is the weak spot
For most organisations, electronic transfer is the biggest risk. A passport copy sent as an email attachment, a construction drawing sent through a free transfer service, a case file in a personal cloud folder: these are everyday actions in which the organisation loses sight of who opens, forwards or keeps the file.
Afterwards, it is often impossible to reconstruct what happened to the file. That is exactly the evidence an auditor asks for. Read more about preventing data breaches caused by human error.
What ISO 27002 expects, in four building blocks
ISO 27002 gives guidance on how to implement control 5.14. We group it into the four building blocks Msafe uses for control over file sharing: Policy, Access, Use and Evidence.
| Building block | What ISO 27002 asks | Example of evidence |
|---|---|---|
| Policy | Rules per type of transfer and per classification, taking legal and contractual requirements into account | Approved information transfer policy, reviewed annually |
| Access | Agreements with external parties on transfers, and control over who the recipient is | Data processing agreements, confidentiality agreements, recorded recipients |
| Use | Protection against interception, copying, modification and malware, in line with the classification; labelling of sensitive information | Encryption, expiry dates on share links, labelled documents |
| Evidence | Traceability of who received what and when; rules for retention and deletion | Logs per transfer, configured retention periods |
What evidence does an auditor ask for?
During an ISO 27001 audit, the auditor wants to see that policy and practice match. Expect questions about:
- An approved policy or procedure for information transfer, with the date of the last review.
- Agreements with external parties you exchange information with on a regular basis.
- An overview of approved file sharing channels, and which channels are not allowed.
- Logs showing who shared, received and downloaded which file, and when.
- Evidence that staff know the rules, such as training records.
- Examples of labelled documents and how they were handled.
A policy without logs is an intention, not evidence. Read more in Demonstrable compliance.
Related controls
Control 5.14 does not stand alone. These controls are often reviewed together:
| Control | Subject | Link with information transfer |
|---|---|---|
| 5.12 | Classification of information | Determines which rules apply to each file |
| 5.13 | Labelling of information | Makes the classification visible to sender and recipient |
| 5.20 | Addressing information security within supplier agreements | Records agreements with external parties |
| 6.6 | Confidentiality or non-disclosure agreements | Binds recipients to confidentiality |
| 8.15 | Logging | Provides evidence of who did what and when |
| 8.24 | Use of cryptography | Protects files in transit and at rest |
How BIO2 applies control 5.14 in the Netherlands
The Baseline Informatiebeveiliging Overheid 2 (BIO2) is the shared information security framework for Dutch central government, municipalities, provinces and water authorities. The current version, BIO2 1.3, is based on ISO/IEC 27001 and ISO/IEC 27002 and adds specific government measures. It replaces the three fixed baseline security levels of the original BIO with a risk-based approach.
Since the Dutch Cybersecurity Act (Cyberbeveiligingswet) entered into force on 15 August 2026, the BIO2 government measures are mandatory for organisations within its scope. Government bodies outside the act apply the BIO2 through self-regulation. For Dutch municipalities, see secure document exchange under the Cybersecurity Act, and for the evidence the act requires, see The Cybersecurity Act and admissibility of evidence.
In Belgium, the Centre for Cybersecurity Belgium assesses NIS2 entities through CyberFundamentals or ISO 27001. A well-implemented control 5.14 is recognisable evidence on both sides of the border. Read more on our NIS2 and secure file sharing page.
Setting up secure information transfer in five steps
- Map every channel. List how files leave the organisation: email, transfer services, cloud storage, portals and USB. Ask the teams themselves, because shadow channels rarely appear in an IT overview.
- Classify the information. Decide which types of information you exchange, such as public, internal, confidential and personal data, and assign an approved channel to each type.
- Record rules and agreements. Describe per type of information how a transfer must take place, and make agreements with the external parties you exchange with on a regular basis.
- Choose one managed channel for confidential files. Separate the message from the file: email for the message, the file in a secure environment with access control, expiry date and logging. That makes every transfer traceable. Read more in Emailing sensitive documents.
- Record evidence automatically and review annually. Let the system keep logs and retention periods, and review policy and channels at least once a year.
How Msafe helps
Msafe Secure File Transfer is built for organisations that share files with external parties and need to prove it. Staff share from the browser or Outlook. The organisation keeps control over access, retention periods and what happens during each transfer.
- Files and shares are encrypted with AES-256.
- For each share, you decide who gets access and how long the file stays available.
- Every transfer is recorded: who shared, opened and downloaded what.
- User management through Single Sign-On and SCIM with Microsoft Entra ID.
- Files up to 1 TB, larger on request.
- Data hosting in the Netherlands.
- Msafe itself is ISO/IEC 27001:2022 certified by DEKRA. SOC 2 Type I is being finalised.
More figures and facts are on Msafe facts.
Frequently asked questions about ISO 27001 and secure file sharing
Is control 5.14 mandatory under ISO 27001?
Annex A controls are selected based on your risk assessment and recorded in the Statement of Applicability. If you exclude control 5.14, you have to justify it. Because almost every organisation exchanges information with external parties, the control is rarely excluded in practice.
Does email count as information transfer?
Yes. Email is electronic transfer and falls under control 5.14. For confidential files, it is wise to separate the message from the file, so that access, expiry and logging are managed per file.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 contains the requirements for an information security management system and a list of controls in Annex A. ISO 27002 explains each control and gives guidance on implementing it. The BIO2 uses both: ISO 27001 for the management system and ISO 27002 for the measures.
Is the BIO2 mandatory?
The BIO2 applies to all Dutch government layers. For organisations within the scope of the Cybersecurity Act, the BIO2 government measures have been mandatory since 15 August 2026. Other government bodies apply it through self-regulation.
What changed from ISO 27001:2013 to 2022 for information transfer?
The three former controls on transfer policies, transfer agreements and electronic messaging (A.13.2.1 to A.13.2.3) were merged into control 5.14. The scope now explicitly covers electronic, physical and verbal transfer in one control.
Evidence for every transfer, without extra work
In a short demo, we show how Msafe records who shared and received what, for every transfer.
