ISO 27001 A.5.32: Intellectual Property Rights

Quick Reference: A.5.32 in 60 Seconds

What the Standard Actually Requires

Figure · Process

What A.5.32 asks you to do

ISO 27001:2022 A.5.32 Text

ISO 27001:2022 Annex A 5.32 asks organizations to put procedures in place to protect intellectual property rights.

ISO 27002:2022 Implementation Guidance (Section 5.32)

ISO 27002 expands the single "shall" statement into twelve practical guidance points:

1. Topic-specific policy, Implement a policy on the protection of IP rights, tailored to the organization's operations and risk profile.
2. Procedures for software and ICT products, Publish and communicate clear procedures defining how software and ICT products should be acquired, used, and maintained to remain compliant with IP standards.
3. Reputable sources, Acquire software and digital content only from respected, reputable sources to avoid counterfeit or infringing copies.
4. Asset register, Identify ICT assets that carry IP requirements in the organizational asset register.
5. Proof of ownership, Be able to produce proof of ownership or license at any time, including physical and electronic licensing documents, communications, and files.
6. License usage limits, Comply with agreed software usage limits, including concurrent users, virtual resources, processor/core counts, and geographic restrictions.
7. Periodic reviews, Plan and implement periodic reviews to ensure the ICT estate does not contain unauthorized or unlicensed software.
8. License renewal, Create operational and financial procedures that ensure licenses are kept up to date.
9. Safe transfer and disposal, Establish procedures for the safe, responsible, and legally compliant transfer or disposal of software assets.
10. Public-domain compliance, Ensure compliance with terms, conditions, and fair-use guidelines for any software acquired from the public domain (including open-source and freeware).
11. Commercial recordings, Do not extract, copy, convert, or manipulate commercial recordings in ways not permitted by licensing or copyright law.
12. Textual copyright, Respect and adhere to copyright laws and licensing terms for textual data such as standards, books, articles, and reports.

Shall / Should Analysis

What Auditors Actually Check

Why This Control Matters

The Business Risk Narrative

Intellectual property is often the single most valuable asset class in a modern B2B technology company. For a SaaS startup it is the source code, product roadmap, and customer-facing algorithms. For a manufacturer it is the CAD drawings, process recipes, and tooling designs. For a media or e-commerce company it is the brand identity, product images, marketing content, and customer databases. Losing control of IP does not just mean a lawsuit-it means loss of competitive advantage, erosion of investor confidence, customer churn, and sometimes business failure.

A.5.32 sits at the intersection of information security, legal compliance, and enterprise risk management. While other Annex A controls focus on confidentiality, integrity, and availability of information, A.5.32 focuses on the legal ownership and permitted use of that information. You can have perfect encryption and still fail an audit because 30% of your laptops run unlicensed software, or because a contractor walked away with your source code.

Indian Regulatory Context

Indian organizations operate under a layered compliance environment where IP protection is reinforced by several statutes and regulators:

• The Copyright Act, 1957 (as amended) protects original literary, artistic, musical, and software works. Running unlicensed software, copying proprietary documents, or using pirated images can trigger civil and criminal penalties, including imprisonment up to three years and fines up to per offence.
• The Trade Marks Act, 1999 protects brand names, logos, and service marks. Unauthorized use of third-party trademarks in marketing or product interfaces can lead to infringement suits and takedown orders.
• The Patents Act, 1970 protects inventions and processes. Using patented algorithms or manufacturing techniques without a license can result in injunctions and damages.
• The Designs Act, 2000 protects industrial designs. Copying UI/UX layouts or product packaging can infringe registered designs.
• The Information Technology Act, 2000 (Section 43, 66, 66C, 66D) penalizes unauthorized access, theft, and fraud involving computer resources. Exfiltration of source code or confidential IP can be prosecuted as a cybercrime.
• The Digital Personal Data Protection Act, 2023 does not directly govern IP, but it governs personal data that may be embedded in proprietary datasets, model training data, and customer analytics. Mishandling such data can compound IP and privacy liabilities.
• CERT-In Directions, 2022 require organizations to report specified cyber incidents within six hours. Large-scale IP exfiltration or ransomware that destroys IP may trigger reporting obligations.
• RBI Cyber Security Framework in Banks and the Master Direction on IT Framework for NBFCs require board-approved policies, vendor risk management, and incident reporting. Banks and NBFCs must ensure that licensed software is used in regulated environments and that vendor contracts protect RBI-classified data and IP.
• SEBI cybersecurity circulars for market infrastructure institutions (MIIs) and intermediaries mandate complete policies, data protection, and periodic reporting. IP theft in capital markets can amount to market manipulation or insider trading.
• IRDAI Guidelines on Information and Cyber Security for insurers require protection of policyholder data and business-critical systems, with implicit requirements to use licensed and supported software.

Industry-Specific Consequences

impact of Non-Compliance: Statistics and Realities

• The Business Software Alliance (BSA) has consistently ranked India among the top countries for commercial value of unlicensed software, with historical unlicensed installation rates above 50%. Even a single license shortfall across hundreds of endpoints can result in seven-figure rupee settlements.
• Software audits by vendors such as Microsoft, Adobe, Oracle, and SAP can impose true-up overhead, back-maintenance fees, and penalties ranging from to several crores depending on deployment size.
• Open-source license violations can force an organization to release proprietary source code under copyleft terms, destroying product valuation. GPL enforcement actions have led to injunctions and product recalls.
• IP exfiltration by insiders overhead Indian companies an estimated –50 lakhs per incident in investigation, legal fees, and remediation for growing companies, and can run into crores for product companies.
• Regulatory fines under the IT Act for data theft can reach per violation. DPDP Act penalties can reach for data breaches involving personal data.

These numbers do not capture the hidden overhead: delayed funding rounds, lost enterprise deals, and the months of management distraction spent defending audits or litigation.

The Hidden impact of an IP Failure

Beyond fines and true-up payments, an IP failure creates a cascade of indirect overhead that rarely appear in the initial incident report. Smart organizations account for these overhead when building the business case for an IPR program.

Direct overhead

• Vendor audit settlements and license true-ups.
• Legal fees for defense, contract disputes, and enforcement actions.
• Remediation engineering for open-source license contamination or unauthorized asset removal.
• Forensic investigation and incident response for IP theft or suspected exfiltration.
• Regulatory fines and penalties under the Copyright Act, IT Act, and sectoral regulations.

Indirect overhead

• Customer and investor trust: A publicized IP dispute signals poor governance. Enterprise customers may terminate contracts, exclude the vendor from RFPs, or demand damaging audits.
• Management distraction: Leadership can spend 20–40% of their time for several quarters managing audits, litigation, and remediation instead of growing the business.
• Valuation impact: For startups and scale-ups, unaddressed IPR gaps can reduce valuation by 10–30% during funding or acquisition due to legal risk and uncertainty.
• Opportunity overhead: Engineering teams pulled off roadmap work to rewrite contaminated code or respond to audits delay product launches and revenue recognition.
• Employee morale: Developers may become frustrated by sudden restrictions if governance is introduced without training and communication.
• Insurance and financing: Cyber insurers may increase premiums or exclude IP-related claims. Lenders may impose covenants or reduce credit exposure.

Sample overhead Categories

The real lesson is that IPR is not a compliance checkbox-it is a financial and strategic risk that belongs in the boardroom. Organizations that treat A.5.32 as a proactive investment rather than a reactive audit requirement consistently outperform their peers in customer trust, funding outcomes, and operational resilience. Building a strong IPR posture today prevents the emergency spending, legal exposure, and reputational damage that can derail growth tomorrow.

Scope and Applicability

What the Control Covers

A.5.32 applies to all intellectual property that the organization owns, licenses, uses, or distributes. This includes:

• Proprietary software and source code developed in-house or by contractors.
• Commercial software licenses, perpetual, subscription, SaaS, enterprise agreements, and OEM bundles.
• Open-source and free software including libraries, frameworks, fonts, icons, and tools.
• Copyrighted documents, standards, whitepapers, reports, training material, proposals, and marketing content.
• Trademarks and brand assets, logos, taglines, product names, domain names.
• Patents and patent-pending inventions including algorithms, business methods, and industrial processes.
• Industrial designs and CAD files, product designs, molds, tooling, packaging.
• Trade secrets and know-how, customer lists, licensing models, formulas, roadmaps.
• Digital media, images, videos, music, sound effects, fonts, templates.
• Datasets and model weights, training data, embeddings, ML models, analytics outputs.

Who It Applies To

The control applies to:

• All employees, interns, and trainees.
• Contractors, freelancers, and consultants.
• Outsourced development partners and Managed Service Providers (MSPs).
• Suppliers and vendors who handle the organization's IP.
• Customers and partners who receive IP under license or data-sharing agreements.
• Board members and senior leadership who approve IP strategy.

Role Categories

Size-Based Applicability

Key Definitions and Terminology

Relationship to Other Controls

Upstream Controls (Provide Input to A.5.32)

Parallel Controls (Operate Alongside A.5.32)

Downstream Controls (Receive Input from A.5.32)

Detailed Implementation Guidance

The IPR Implementation Model

We recommend a seven-phase model that moves from governance to continuous monitoring:

┌─────────────────────────────────────────────────────────────┐
│  PHASE 1: GOVERNANCE                                        │
│  • Approve IPR policy and assign owner                       │
│  • Identify legal and contractual obligations                │
│  • Define IP asset categories and classification             │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  PHASE 2: DISCOVERY                                         │
│  • Inventory software, source code, designs, media           │
│  • Map ownership and licenses                                │
│  • Identify unauthorized or unlicensed items                 │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  PHASE 3: CONTROL DESIGN                                    │
│  • Design procurement, access, labeling, and disposal rules  │
│  • Implement SAM/SCA/DLP tooling                             │
│  • Draft employment and vendor IP clauses                    │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  PHASE 4: REMEDIATION                                       │
│  • Remove unlicensed software                                │
│  • True-up license shortfalls                                │
│  • Resolve OSS license conflicts                             │
│  • Secure high-value IP repositories                         │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  PHASE 5: OPERATIONALIZATION                                │
│  • Run approval workflows for new software/media             │
│  • Train employees and contractors                           │
│  • Acknowledge IPR policy                                    │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  PHASE 6: MONITORING & REVIEW                               │
│  • Quarterly license reconciliation                          │
│  • Periodic unauthorized software scans                      │
│  • Annual IPR policy review                                  │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│  PHASE 7: CONTINUOUS IMPROVEMENT                            │
│  • Incident-driven policy updates                            │
│  • Maturity benchmarking                                     │
│  • Board reporting and optimization                          │
└─────────────────────────────────────────────────────────────┘

Step-by-Step Implementation

Step 1: Establish the IPR Governance Board

Create a cross-functional IPR working group with representatives from Legal, IT/Security, Procurement, HR, R&D/Product, and Finance. The board meets quarterly to review IP risks, license spend, audit findings, and policy changes. Define RACI: Legal owns contracts and legal interpretation, CISO owns technical controls, Procurement owns vendor licensing, HR owns employment clauses, and CTO/Product owns source code and R&D IP.

Step 2: Conduct a Legal and Contractual Review

List all laws, regulations, and contractual obligations that affect IP. For Indian companies this includes the Copyright Act, Trade Marks Act, Patents Act, Designs Act, IT Act, DPDP Act, sectoral RBI/SEBI/IRDAI guidelines, and customer contracts. Document these in the legal register (A.5.31). Identify license types in use: perpetual, subscription, SaaS, enterprise, OEM, academic, open-source, freeware, trial.

Step 3: Build the IP Asset Register

Extend the information asset register (A.5.9) with an IP lens. For each asset record:

• Asset name and description
• Asset owner and custodian
• Asset classification (Public, Internal, Confidential, Restricted)
• IP category (software, source code, design, document, media, patent, trademark, dataset, trade secret)
• License type and license key / entitlement ID
• Licensor/vendor name
• Number of entitled users/devices/installations
• Actual usage count
• Purchase/order reference
• Expiry/renewal date
• Location (on-prem, cloud, endpoint)
• Restrictions (geo, concurrent, virtualization, sub-licensing)
• Open-source license (if applicable)
• Link to proof of ownership or license agreement

For software, use automated discovery tools where possible and validate with manual spot checks.

Step 4: Implement Software Asset Management (SAM)

SAM is the operational backbone of A.5.32. Key processes:

• Procurement gate: No software may be purchased or deployed without procurement and security approval. Cloud app procurement must pass through the sanctioned SaaS list.
• License entitlement management: Centralize purchase orders, EULAs, and SaaS admin consoles. Reconcile entitlements against installations monthly.
• Usage optimization: Identify shelfware and unused subscriptions; reharvest licenses before buying new ones.
• Renewal workflow: Finance receives 90/60/30-day renewal alerts; no auto-renewal without owner confirmation.
• True-up process: When audits reveal overuse, document the decision to buy more licenses or remove installations.

Step 5: Govern Open-Source Software

Open-source is not free of obligations. Implement an OSS governance program:

• Maintain an approved open-source license whitelist (e.g., MIT, Apache 2.0, BSD, PostgreSQL, LGPL with conditions) and blacklist (e.g., GPL-3.0 in proprietary products, AGPL, proprietary-style licenses with onerous terms).
• Integrate SCA into CI/CD to scan every commit and pull request.
• Require developers to declare new OSS components in a request form.
• Review copyleft and license compatibility before release.
• Maintain a Software Bill of Materials (SBOM) for every product release.
• Train engineering on license obligations and contribution policies.

Step 6: Protect Employment-Related IP

Ensure the organization owns what its people create:

• Include "work for hire" and IP assignment clauses in all employment agreements.
• For contractors and agencies, use standalone IP Assignment Agreements and NDAs before sharing confidential information.
• Define "scope of employment" clearly for creators working on side projects or open-source contributions.
• Document pre-existing IP brought by employees to avoid disputes.
• Include post-employment confidentiality and non-solicitation clauses where enforceable under Indian law.

Step 7: Control Access to High-Value IP

Apply defense-in-depth to IP repositories and endpoints:

• Enforce role-based access control (RBAC) and least privilege for source code, design, and document repositories.
• Require MFA for all access to IP-bearing systems.
• Use DLP rules to block bulk downloads of source code, CAD files, and customer lists to personal cloud storage or USB.
• Apply digital watermarks or metadata labels to confidential documents and designs.
• Log and review access to critical IP assets; flag anomalous access outside business hours or from unusual locations.

Step 8: Secure Procurement and Vendor IP Clauses

Every vendor agreement that involves IP should include:

• Clear ownership of deliverables and background IP.
• License grant scope (use, modify, sublicense, territory, duration).
• Confidentiality and data protection obligations.
• Right to audit for license compliance.
• Return or secure destruction of IP on termination.
• Indemnification for IP infringement caused by vendor deliverables.
• Sub-processor and open-source disclosure obligations.

For cloud/SaaS vendors, verify that the organization retains ownership of its data and that the vendor does not train AI models on customer data without consent.

Step 9: Manage Media and Content Use

Marketing, HR, and L&D teams frequently use images, videos, music, and fonts. Establish:

• A central, pre-approved media library with clear license terms (e.g., Shutterstock, Adobe Stock, Envato, Unsplash for limited use).
• Prohibition on downloading "free" assets from random websites.
• License tracking for stock media, including model releases and usage limits.
• Clear rules on using third-party trademarks, logos, and celebrity images.
• Accessibility and DPDP Act consent checks for images containing personal data.

Step 10: Implement Safe Transfer and Disposal

When software or IP assets are no longer needed:

• Uninstall software and revoke licenses in the SAM tool.
• Return physical media and license certificates to the vendor if required.
• For source code and design repositories, follow retention and archival policies.
• For disposal of endpoints, use secure wipe (NIST 800-88 Clear/Purge/Destroy) and record destruction.
• For trade-secret documents, use cross-cut shredding or certified e-waste destruction.
• Maintain disposal records for audit evidence.

IPR Controls by Asset Type

Different IP assets carry different risks and require tailored controls. The following matrix maps asset types to recommended controls.

Software and SaaS Software is the most frequently audited IP category. Treat SaaS subscriptions as licenses with renewal dates, user counts, and feature tiers. Map each SaaS application to a business owner and require re-certification before renewal. When employees leave, reclaim SaaS seats immediately-unused SaaS licenses are a common source of both waste and compliance ambiguity. Document any Bring-Your-Own-License (BYOL) arrangements with cloud providers and ensure that virtualization and container use does not exceed core-based entitlements.

Source Code Source code is the crown jewel for technology companies. Use repository branch protection, require pull-request reviews with at least one security-aware reviewer, scan for secrets and unauthorized OSS, and restrict fork/export permissions. Maintain an SBOM for every release so customers and auditors can verify license hygiene. For on-premise deployments, ensure that source code escrow agreements are in place for critical third-party components.

Digital Media Marketing teams often unintentionally infringe copyright because they assume online content is free. Provide a curated library and a simple approval path for exceptions. Include "no internet downloads" in the acceptable use policy. For user-generated content, obtain model releases and consent documentation to comply with both copyright and DPDP Act requirements.

Datasets and AI Models With the rise of generative AI and machine learning, datasets and model weights have become portable, high-value IP. Classify them as Restricted, apply encryption at rest and in transit, and include clauses in cloud vendor contracts that prohibit training on your data. If you license training data from third parties, ensure the license permits your intended use, including fine-tuning and commercial deployment.

Trade Secrets Trade secrets rely on secrecy rather than registration. Limit access to the smallest group necessary, use NDAs, conduct exit interviews reminding leavers of confidentiality obligations, and monitor for unusual access patterns. Document the "reasonable efforts" you take to maintain secrecy-this is essential if you ever need to enforce trade-secret rights in court. In India, courts look for documented confidentiality agreements, access controls, and training records when deciding whether information qualifies as a trade secret. Therefore, a strong trade-secret program is both an information security control and a legal prerequisite for enforcement.

Implementation by Organization Size

Small Organizations (1–50 employees)

• Use a simple spreadsheet for software inventory and a shared folder for license documents.
• Purchase software only through a single authorized channel.
• Include IP assignment clauses in offer letters.
• Use only approved stock-image subscriptions.
• Review quarterly.

Medium Organizations (50–500 employees)

• Adopt a lightweight SAM tool (e.g., ManageEngine AssetExplorer, Snipe-IT, or Lansweeper).
• Implement procurement workflow in the ITSM tool.
• Add SCA scanning for development teams.
• Deploy DLP for source code and design repositories.
• Conduct bi-annual IPR internal audits.

Large/Enterprise Organizations (500+ employees)

• Deploy enterprise SAM (Flexera, Snow, ServiceNow SAM) integrated with procurement and HR.
• Implement global license optimization and chargeback.
• Use dedicated brand protection and trademark monitoring services.
• Run continuous SCA, DLP, and access analytics.
• Establish an IP risk dashboard for the board.

Tools, Technologies, and Solutions

Tool Categories

Vendor Comparison Matrix

Build vs. Buy Guidance

Policy and Procedure Templates

Intellectual Property Rights (IPR) Policy Template

INTELLECTUAL PROPERTY RIGHTS POLICY
[Organization Name]
Version: 1.0
Approved by: [CISO / Legal Counsel / CEO]
Date: [Date]
Review Date: [Date + 12 months]
Classification: Internal

1. PURPOSE
This policy defines [Organization Name]'s approach to identifying, protecting,
and managing intellectual property rights in compliance with ISO 27001:2022
Annex A 5.32 and applicable Indian and international laws.

2. SCOPE
This policy applies to all employees, contractors, consultants, vendors, and
third parties who create, use, manage, or have access to [Organization Name]
intellectual property or third-party licensed materials.

3. POLICY STATEMENTS

3.1 Ownership of Work Product
All work product created by employees within the scope of employment is the
property of [Organization Name] under the "work for hire" doctrine. Contractors
must sign an IP Assignment Agreement before accessing confidential information
or creating deliverables.

3.2 Software Licensing
Only properly licensed software from approved vendors may be installed or used
on [Organization Name] assets. Unlicensed, cracked, pirated, or unauthorized
software is prohibited. All software purchases must be approved by Procurement
and IT Security.

3.3 Open-Source Software
Developers may only use open-source components that have been approved through
the OSS governance process. Copyleft licenses require Legal review before use.
All OSS components must be recorded in the SBOM.

3.4 Third-Party Content
Employees may only use images, videos, music, fonts, documents, and templates
from approved sources with valid licenses. Trademarks and logos of third
parties may not be used without written permission.

3.5 Confidentiality and Protection
High-value IP (source code, designs, customer lists, trade secrets) must be
stored in approved repositories with access limited by role. Bulk downloads,
screenshots, and transfers to personal devices or cloud storage are prohibited
unless authorized.

3.6 Procurement and Contracts
All vendor agreements must specify IP ownership, license scope,
confidentiality, return/destruction, and infringement indemnification.

3.7 Monitoring and Compliance
[Organization Name] reserves the right to scan devices and repositories for
unauthorized software and IP. Non-compliance may result in disciplinary action,
contract termination, or legal proceedings.

3.8 Reporting
Employees must immediately report suspected IP infringement, unauthorized
software, or IP exfiltration to the CISO or Legal Counsel.

4. ROLES AND RESPONSIBILITIES
- CISO / IPR Policy Owner: Maintain policy, coordinate audits, report to board.
- Legal Counsel: Interpret laws, review contracts and OSS licenses.
- Procurement: Ensure license compliance in purchases.
- IT / Security: Maintain SAM tool, enforce technical controls.
- HR: Include IP clauses in employment contracts and exit process.
- All Employees: Comply with policy, use only approved assets, report issues.

5. ENFORCEMENT
Violations of this policy may result in corrective action, disciplinary action
up to and including termination, and civil or criminal liability under
applicable law.

6. REVIEW
This policy is reviewed annually and upon significant changes in operations,
technology, or regulation.

7. ACKNOWLEDGMENT
All personnel must acknowledge this policy at onboarding and after any
material change.

IPR Procedure: Software License Compliance

PROCEDURE: SOFTWARE LICENSE COMPLIANCE
Version: 1.0
Owner: IT Asset Manager

OBJECTIVE
Ensure all software used by [Organization Name] is properly licensed and used
within entitlement limits.

PROCEDURE STEPS

1. REQUEST
   a. Employee or manager submits software request via ITSM ticket.
   b. Request includes business justification, number of users, and preferred
      vendor.

2. APPROVE
   a. Manager approves business need.
   b. IT Security confirms compatibility and security posture.
   c. Procurement confirms vendor is approved and negotiates license terms.

3. PURCHASE
   a. Procurement issues purchase order.
   b. License certificate, EULA, and proof of purchase stored in contract
      repository and linked in SAM tool.

4. DEPLOY
   a. IT installs software via approved package or self-service portal.
   b. License key assigned to user/device in SAM tool.

5. MONITOR
   a. SAM tool reconciles installations against entitlements monthly.
   b. Overuse is flagged for true-up or removal.
   c. Unused licenses are identified for reharvesting.

6. RENEW
   a. Finance receives 90/60/30-day renewal alerts.
   b. Owner confirms continued need and user count.
   c. Renewal executed and records updated.

7. DISPOSE
   a. On termination or replacement, software is uninstalled.
   b. License is reclaimed or returned per vendor terms.
   c. Disposal recorded in SAM tool and asset register.

8. AUDIT
   a. Quarterly internal spot-check of 10% of endpoints.
   b. Annual comprehensive license reconciliation.
   c. Findings logged in corrective action register.

RECORDS
- ITSM tickets
- Purchase orders and invoices
- License certificates and EULAs
- SAM reconciliation reports
- Disposal records

IPR Procedure: Open-Source Approval

PROCEDURE: OPEN-SOURCE SOFTWARE APPROVAL

1. Developer identifies a required OSS component.
2. Developer completes OSS Request Form with component name, version, source,
   license, and intended use.
3. SCA tool scans component for license, vulnerabilities, and dependencies.
4. Legal reviews license for copyleft, patent, and commercial restrictions.
5. Security reviews component for known vulnerabilities.
6. Component is added to approved SBOM or rejected with justification.
7. Developer is notified and usage is tracked.

Risk Assessment and Treatment

IP Risk Register (Sample)

Risk Treatment Options

Residual Risk Acceptance

Any residual high-risk items must be accepted by the CISO or CEO with documented justification. Accepted risks are reviewed quarterly.

Audit and Compliance Checklist

Auditor Questions and Evidence

Pre-Audit Self-Assessment

Before the certification or surveillance audit, complete this self-assessment:

• IPR policy is current, approved, and acknowledged by >95% of staff.
• Software asset register covers 100% of endpoints and servers.
• License entitlement vs. usage reconciliation completed in the last quarter.
• All unlicensed software removed or true-up completed.
• SBOM generated for the last product release.
• All employment and contractor contracts include IP clauses.
• Access reviews completed for source code and design repositories.
• DLP policies active for IP exfiltration vectors.
• Vendor contract template includes IP protection clauses.
• Disposal records available for the last 12 months.
• Management review minutes include IP risk discussion.
• Internal audit findings for A.5.32 are closed.

Metrics and KPIs

IPR Governance Scorecard

Sample IPR Dashboard

┌──────────────────────────────────────────────────────────────┐
│  IPR DASHBOARD — June 2026                                  │
├──────────────────────────────────────────────────────────────┤
│  Software License Compliance      99.2% ████████████████████░ │
│  OSS Approval Coverage            100%  █████████████████████ │
│  IPR Policy Acknowledged          97%   ███████████████████░░ │
│  High-Value IP Access Reviewed    100%  █████████████████████ │
│  Renewals Due ≤30 Days            3     → Action required     │
│  Unauthorized Software Detected   0     → Good                │
│  Open IPR Audit Findings          1     → Due 2026-07-15      │
└──────────────────────────────────────────────────────────────┘

Target Setting by Maturity

Common Pitfalls / Audit Failures & How to Avoid Them

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Mumbai Manufacturing Firm, The Unlicensed Software Audit

Background A 250-employee precision engineering company in Mumbai supplied components to automotive OEMs. The company had grown rapidly through acquisitions and had no centralized IT procurement. Each plant manager bought software independently, and the design team relied on AutoCAD, SolidWorks, and Adobe tools.

The Incident In early 2025, a major OEM customer requested evidence of license compliance as part of its supplier sustainability audit. The company could produce purchase records for only 60% of its installed design and productivity software. A follow-up scan revealed:

• 47 unlicensed installations of CAD software across three plants.
• 120 installations of Microsoft Office without sufficient Office 365 licenses.
• Multiple copies of cracked PDF and image editing tools on shop-floor PCs.
• No centralized asset register or license certificates.

The OEM placed the supplier on probation and threatened to remove them from the approved vendor list. Software vendor audit letters followed, demanding true-up payments estimated at plus penalties.

Root Cause Analysis

1. Decentralized purchasing, No procurement gate or approved vendor list.
2. No SAM process, License tracking was non-existent; IT did not know what was installed.
3. Cultural tolerance, Shop-floor supervisors believed "everyone uses cracked tools."
4. No awareness, Employees did not understand that unlicensed software was a business risk.
5. Weak management oversight, IP and software compliance were never discussed at board level.

Remediation The company engaged Singahi to implement an IPR framework:

Phase 1 (Weeks 1–2): Stabilize

• Declared an immediate moratorium on new software purchases.
• Deployed an agentless discovery tool (Lansweeper) to map all installations.
• Deleted cracked tools and unauthorized software from all endpoints.
• Purchased emergency true-up licenses to close the most critical gaps.

Phase 2 (Weeks 3–6): Govern

• Approved an IPR policy co-owned by the CFO and CISO.
• Implemented a procurement gate via the ITSM system.
• Centralized license certificates and purchase orders in a contract repository.
• Trained all plant managers and designers on approved software and reporting.

Phase 3 (Weeks 7–12): Optimize

• Adopted ManageEngine AssetExplorer for ongoing SAM.
• Set up quarterly reconciliation and 90-day renewal alerts.
• Negotiated an enterprise agreement with the CAD vendor, reducing per-seat overhead by 18%.
• Added IP clauses to all supplier and contractor agreements.

Results

• License compliance improved from 60% to 99.5% within four months.
• True-up and penalty overhead reduced from to through negotiation and remediation.
• OEM supplier status restored; company won a multi-year contract that had been at risk.
• Passed a follow-up ISO 27001 surveillance audit with zero IPR findings.
• Recovered annually by identifying and reharvesting unused licenses.

Key Lessons

1. Decentralized purchasing is the enemy of license compliance.
2. A single discovery exercise can reveal hidden liabilities worth crores.
3. Management tone matters: when the CFO treated IPR as a board-level risk, behavior changed.
4. License optimization pays for itself-unused licenses are cash left on the table.
5. Customer audits are becoming standard; IPR readiness is a competitive advantage.

Illustrative Scenario 2: Bengaluru Fintech Startup, Source Code Exfiltration and OSS License Contamination

Background A 90-employee Bengaluru fintech startup built a lending platform used by NBFCs. The engineering team included 25 full-time developers and 15 contractors in India and Ukraine. The company was preparing for a Series B funding round and an ISO 27001 certification.

The Incident During investor due diligence, two critical issues surfaced:

1. OSS license contamination: An SCA scan commissioned by the investor found that the platform contained 18 GPL-2.0-licensed libraries linked directly into the proprietary backend. The startup's distribution model (on-premise deployment at customer data centers) triggered copyleft obligations that could force disclosure of the entire backend source code.
2. Source code exfiltration: A recently terminated Ukrainian contractor had downloaded the entire Git repository to a personal cloud storage account two days before leaving. The contractor's agreement did not contain a clear IP assignment clause enforceable under Indian or Ukrainian law.

The investor made the funding contingent on resolving both issues. The estimated impact of rewriting the GPL-infected modules was and three months of engineering time. The exfiltration triggered a legal response and delayed the certification by six months.

Root Cause Analysis

1. No OSS governance: Developers chose libraries based on functionality, not license. No SCA tool was in use.
2. Weak contractor IP clauses: The contractor agreement was a generic service agreement with no explicit IP assignment or return/destruction obligations.
3. No DLP on repositories: Bulk downloads to personal cloud were not blocked or alerted.
4. No access review: The contractor retained access until the last day; offboarding was delayed by HR.
5. No board-level IP risk view: The CTO believed "we own the code because we paid for it," misunderstanding contractor IP law.

Remediation The startup engaged Singahi for a full A.5.32 implementation:

Phase 1 (Weeks 1–3): Contain and Assess

• Revoked the contractor's access immediately and sent a legal notice demanding deletion and confirmation.
• Conducted a full SCA scan across all repositories.
• Quarantined GPL-infected modules and identified replacement libraries with permissive licenses.
• Reviewed all active contractor agreements and required signed IP Assignment Addendums.

Phase 2 (Weeks 4–8): Remediate

• Rewrote or replaced 14 of the 18 GPL libraries; obtained commercial licenses for the remaining 4.
• Integrated Snyk SCA into the CI/CD pipeline with a license policy.
• Created an approved OSS license whitelist and a developer approval workflow.
• Deployed Microsoft Purview DLP rules to block bulk downloads from GitHub and cloud storage.

Phase 3 (Weeks 9–16): Institutionalize

• Approved an IPR policy and trained all engineering and product staff.
• Updated employment and contractor templates with enforceable IP assignment clauses.
• Implemented quarterly access reviews and automated leaver access revocation.
• Generated an SBOM for every release and added it to customer security documentation.

Results

• Series B closed six months late but at the original valuation; the investor's security concerns were fully addressed.
• ISO 27001 certification achieved with no major findings on A.5.32.
• Customer security questionnaires now completed in two days instead of two weeks.
• Engineering velocity initially dropped 15% during remediation but recovered as the approval workflow became routine.
• The company added an "IP Risk" slide to every board deck.

Key Lessons

1. Contractor agreements are not optional paperwork-they determine who owns your product.
2. GPL in proprietary products is a funding and exit killer; SCA is non-negotiable.
3. DLP must cover code repositories, not just endpoints.
4. Funding due diligence will increasingly include IPR audits; prepare early.
5. IPR is a board-level risk in technology companies.

Multi-Framework Mapping

Control Mapping Table

Mapping Notes

• SOC 2 Type II: CC1.2 (communication of information objectives) and CC1.3 (establishment of responsibility) support the IPR policy and governance. CC6.1 (logical access) and CC6.6 (encryption) map to access controls for IP repositories.
• PCI DSS 4.0: Requirements 12.3 (security impact analysis), 12.4 (acceptance of risk), 12.5 (maintenance of information security policy) align with IPR governance and policy maintenance.
• NIST 800-53 Rev 5: CM-10 (software usage restrictions) and CM-11 (user-installed software) are directly relevant. PS-6 (access agreements) and PS-7 (external personnel security) map to employment and contractor IP clauses. SA-4 (acquisition) and SA-9 (external system services) map to vendor IP clauses.
• CIS Controls v8: Data protection, vulnerability management, malware defenses, and network monitoring all contribute to preventing unauthorized software and IP exfiltration.
• COBIT 2019: APO01 (managed I&T management framework) and APO12 (managed risk) establish governance; DSS01 (managed operations) and DSS05 (managed security services) operationalize controls.
• GDPR / DPDP Act 2023: While focused on personal data, security of processing and breach notification obligations overlap when IP assets contain personal data or when IP theft involves data breaches.

Industry-Specific Mapping

Implementation Roadmap

Standard 8-Week Roadmap

90-Day Sprint for New ISMS

Ongoing Cadence

FAQ

Does A.5.32 apply only to software?

No. While software licensing is the most common audit focus, A.5.32 covers all intellectual property: source code, patents, trademarks, designs, copyrighted documents, digital media, datasets, and trade secrets. Your procedures must address each relevant category.

Can a small company satisfy A.5.32 with just a policy?

No. ISO 27001 requires procedures that are implemented and operating. A policy alone is insufficient. You also need evidence of an asset register, license tracking, employment clauses, and periodic review.

Do we need a separate IPR policy, or can it be part of another policy?

For small organizations, IPR rules can be embedded in the Acceptable Use Policy or IT Security Policy. For medium and large organizations, a dedicated topic-specific IPR Policy is strongly recommended and expected by auditors.

How often should we review software licenses?

Reconcile license entitlements against actual usage at least monthly. Review the IPR policy annually and after any significant change such as a new product launch, merger, or regulatory update.

What is the biggest open-source license risk?

Copyleft licenses such as GPL, AGPL, and LGPL can require you to release your proprietary source code if you distribute derivative works. Always run SCA and obtain Legal review before using copyleft components in commercial products.

Can employees use free images from the internet?

Only if the image has a clear license permitting commercial use and you retain proof. The safest approach is to use an approved stock-media subscription or a vetted creative-commons library. Random search-engine images are high risk.

What should we do if we find unlicensed software?

Remove or uninstall it immediately, document the finding, determine the root cause, and decide whether to purchase licenses or discontinue use. Repeat offenders should face disciplinary action.

How do we protect IP when using contractors?

Require signed NDAs and IP Assignment Agreements before sharing any confidential information. Use least-privilege access, monitor activity, revoke access on termination, and include return/destruction clauses.

Is source code escrow relevant to A.5.32?

Yes. Source code escrow protects your continuity rights if a vendor goes out of business. It also demonstrates that you have procedures to safeguard access to critical IP. Escrow agreements should be reviewed as part of vendor IP clauses.

How does A.5.32 relate to the DPDP Act 2023?

While A.5.32 focuses on IP rights, many IP assets contain personal data. The DPDP Act requires reasonable security safeguards and breach notification. An IPR program that protects datasets, ML models, and customer analytics also supports DPDP compliance.

What evidence do auditors expect for A.5.32?

Auditors expect: an approved IPR policy, an IP/software asset register, proof of licenses, reconciliation reports, employment/contractor IP clauses, SCA reports (if applicable), DLP/access controls, disposal records, training records, and management review minutes.

How long does it take to implement A.5.32?

A focused organization can reach baseline compliance in 4–8 weeks. Achieving maturity levels 4–5 with automated SAM, SCA, and DLP typically takes 3–6 months.

References and Further Reading

Standards and Frameworks

• ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, Information security management systems, Requirements
• ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection, Information security controls
• ISO/IEC 27036, Information security for supplier relationships
• ISO/IEC 19770, Information technology, IT asset management
• NIST Special Publication 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations
• NIST SP 800-88 Rev 1, Guidelines for Media Sanitization
• CIS Controls v8, Center for Internet Security
• COBIT 2019, ISACA
• SOC 2 Trust Services Criteria, AICPA
• PCI DSS 4.0, PCI Security Standards Council

Indian Laws and Regulations

• The Copyright Act, 1957 (as amended)
• The Trade Marks Act, 1999
• The Patents Act, 1970
• The Designs Act, 2000
• The Information Technology Act, 2000
• The Digital Personal Data Protection Act, 2023
• RBI Cyber Security Framework in Banks, 2016
• RBI Master Direction on IT Framework for NBFCs, 2017
• SEBI Circulars on Cyber Security and Cyber Resilience
• IRDAI Guidelines on Information and Cyber Security for Insurers
• CERT-In Directions, 2022

Useful Resources

• BSA | The Software Alliance, Global Software Survey
• Open Source Initiative (OSI), License list
• SPDX (Software Package Data Exchange), sbom.dev
• OWASP Dependency-Check
• Linux Foundation OpenChain Project
• MeitY, National Cyber Security Policy and Data Protection Guidance