What evidence does ISO 27001:2022 5.32 need?

Statement of Applicability entry for control A.5.32, showing inclusion or justified exclusion, implementation status and the risks it treats. The topic-specific intellectual property policy and compliance procedures for use of software and information products. A software asset register flagging assets with intellectual property requirements and linked proof of licence ownership

5.32 of ISO 27001:2022, stated here in our words and cited to that clause.

Does it map to the other framework?

The held record carries no reviewed link for this control, and does not invent one.

ISO 27001:2022 5.32 evidence: Intellectual property rights

ISO 27001:2022 5.32: Intellectual property rights

ISO 27001:2022 5.32 covers Intellectual property rights. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.5.32, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Licence counts are exceeded in virtualized or cloud environments where CPU-based licensing applies.

Suitable procedures are to be put in place to protect intellectual property rights. Purpose (stated in ISO/IEC 27002:2022): ensures compliance with requirements on intellectual property rights and the use of proprietary products. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.32.

What evidence supports 5.32?

Annex A organizational controlStatement of Applicability entry for control A.5.32, showing inclusion or justified exclusion, implementation status and the risks it treats
Annex A organizational controlThe topic-specific intellectual property policy and compliance procedures for use of software and information products
Annex A organizational controlA software asset register flagging assets with intellectual property requirements and linked proof of licence ownership
Annex A organizational controlLicence compliance reviews reconciling installed software and resource usage (users, CPUs) against entitlements
Annex A organizational controlApproved software sources and purchasing records showing acquisition from reputable suppliers

Where this requirement comes from

This is our own statement of ISO 27001:2022 5.32, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.

Common gaps an assessor flags

Licence counts are exceeded in virtualized or cloud environments where CPU-based licensing applies
Users install software from unvetted sources
Copyrighted documents such as standards are shared internally beyond the licence terms
The organization's own intellectual property is not protected in contracts with staff and third parties

How it maps to SOC 2

No reviewed link is held for this control.

A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.