Zum Hauptinhalt springen
CENEDRIL WIKI
DE
Starter Kit · Policy

Intellectual Property Rights Policy

Updated on 6 min Reviewed by: Cenedril Editorial
A.5.32 ISO 27001BSI ORP.5

Protecting intellectual property sounds like a job for the legal department. In practice, it concerns every person who installs software, writes source code, creates documents or uses third-party content. This policy ensures that you comply with others’ IP rights and protect your own — with clear rules for software licences, open-source compliance and the handling of protected works.

ISO 27001 dedicates a specific control to the topic (A 5.32), and BSI IT-Grundschutz covers it in module ORP.5 (compliance management). Violations of copyright or licence terms can result in fines, damages claims and criminal proceedings — and auditors probe this area closely. Further down you will find the complete template in English and German.

What does it actually cover?

Software is the most valuable operational resource in most organisations today — and simultaneously the area where IP violations happen most easily. A missing licence record, an exceeded installation limit or a GPL component in a proprietary product is enough for a serious problem.

The policy answers questions like: where may software be procured? How do you prove that a licence is valid? What happens when the permitted number of installations is reached? How are open-source dependencies monitored? And who is responsible when an employee embeds a YouTube video in a training presentation?

The scope extends beyond software. Trademarks, patents, design rights, technical documentation and creative works all fall within it. The policy defines the framework for all of these areas — from procurement to disposal, from third-party rights to the organisation’s own intellectual property.

Why is it audit-relevant?

Liability risk with leverage. Software vendors conduct licence audits — some routinely, some after tip-offs. Under-licensing across 50 workstations can trigger six-figure back payments. For open-source violations (copyleft breaches), injunctions and public attention follow, damaging the organisation’s reputation.

Audit focal point. Auditors check A 5.32 for the existence of a licence register, proof of ownership and regular software audits. If any of these is missing, it is a finding. Multiple gaps escalate to a nonconformity.

Connection to other controls. The IPR policy touches the Acceptable Use Policy (which software may be installed), the Secure Development Policy (open source in your own code) and Change Management (introduction of new software). A weak IPR document undermines three other areas.

What goes into it?

The template covers six core areas:

  • Software acquisition (A 5.32) — approved sources only, no pirated copies, no tampered installation files, no peer-to-peer downloads. Every acquisition is recorded in the licence register.
  • Licence management — retain proof of ownership, monitor installation limits, track licence metrics (named user, concurrent user, CPU-based), conduct regular software audits.
  • Open-source compliance — maintain an SBOM (Software Bill of Materials), integrate a licence scanner into the build pipeline, verify copyleft obligations before a component reaches production.
  • Third-party information and content — comply with terms of external data sources, use commercial recordings and publications within licence scope, observe quotation rights.
  • Own intellectual property — regulate work-for-hire in employment contracts, protect trademarks and patents, agree IP clauses with suppliers and partners.
  • Software disposal and transfer — comply with licence terms when uninstalling or transferring software, mark licence keys as deactivated in the register.

How to roll it out

  1. 01

    Inventory your software estate

    Before you write the policy, you need clarity on the current state. What software is in use? What licences exist for it? Where are the records stored? Is there software with no identifiable licence? Endpoint management tools or a software asset management system provide the raw data. This inventory doubles as the foundation for your licence register.

  2. 02

    Build the licence register

    For each software product, document: product name, vendor, licence type (purchase, subscription, open source), permitted installations or usage metrics, actual usage, expiry date, proof of ownership and responsible person. The register is reviewed at least annually and updated with every new acquisition or disposal.

  3. 03

    Set up open-source compliance

    If your organisation develops software, you need an SBOM process. Automated licence scanners (e.g. FOSSA, Snyk, Trivy) check with every build whether new dependencies introduce licence terms that conflict with your business model. Copyleft licences (GPL, AGPL) require particular attention because they can trigger source code disclosure obligations.

  4. 04

    Adapt and approve the template

    The template contains placeholders for organisation name, responsible roles and specific licence rules. Replace them. Remove sections that do not apply — no in-house software development? The open-source section can be shorter. No patents? Remove those passages. Top management approves the finished policy (ISO 27001, Clause 5.2).

  5. 05

    Operationalise software audits

    Schedule at least one annual software audit that compares installed software against the licence register and the approved software catalogue. Unauthorised software is uninstalled. Automated endpoint inventory makes the comparison easier — without it, the audit remains a manual exercise with high effort and patchy coverage.

Where it goes wrong in practice

From audit experience, sorted by frequency:

1. No licence register exists. Software is procured and installed, but nobody documents the licence terms centrally. In an audit, proof of ownership is missing, installation limits are unclear and expiry dates are missed. This is the most common finding for A 5.32.

2. Licence limits exceeded. 50 licences purchased, 73 installations on the network. Some organisations only discover this when the vendor announces a licence audit — by which point it gets expensive. Continuous monitoring of licence metrics is the only reliable countermeasure.

3. Open-source dependencies without review. A developer adds an npm library without checking the licence. Three levels deep in the dependency chain sits a GPL component that triggers disclosure obligations for the entire codebase. An automated licence scanner in the CI/CD pipeline catches these cases.

4. Software from unofficial sources. An employee downloads a free version of a tool from a third-party website. The file contains malware or is a pirated copy. The policy prohibits such downloads — but if procurement channels are not clearly communicated, people find their own solutions.

5. Own IP left unprotected. Employment contracts contain no work-for-hire clause, trademarks are not registered, source code carries no copyright notice. As long as everything runs smoothly, nobody notices. During a separation or legal dispute, the foundation is missing.

Template: Intellectual Property Rights Policy

Full policy text

Intellectual Property Rights Policy

.md · EN.md · DE

Document control
Owner: [POLICY_OWNER_ROLE, e.g. Information Security Officer]
Approved by: [APPROVER_NAME_AND_ROLE]
Version: [VERSION]
Effective date: [EFFECTIVE_DATE]
Next review: [NEXT_REVIEW_DATE]

1. Legal/Regulatory Basis

ISO/IEC 27001:2022 / ISO/IEC 27002:2022, Annex A — Organisational Controls:

  • A 5.32 — Intellectual Property Rights

BSI IT-Grundschutz:

  • ORP.5.A1 (Identification of Legal and Contractual Framework Conditions)
  • ORP.5.A2 (Observance of Legal and Contractual Framework Conditions)
  • APP.3.2.A7 (Protection of Sensitive Data in Web Applications)
  • APP.6.A9 (Rules for Software Development — Licensing Aspects)

Additional jurisdiction-specific laws — in particular national copyright law, software licensing regulations, open-source compliance obligations and sector-specific IP requirements — are listed in the Legal Register and incorporated by reference.

2. Purpose & Scope

This policy establishes rules for protecting intellectual property rights (IPR) at [YOUR_ORGANISATION_NAME]. It ensures that all use of software, information products, data and creative works complies with applicable copyright, licensing and IP laws, and that the organisation's own intellectual property is adequately protected against unauthorised use by personnel and third parties.

The following measures are implemented to protect any material that can be considered intellectual property.

Intellectual property encompasses a broad range of protected assets, including:

  • Software & Document Copyright: Source code, compiled applications, technical documentation, training materials and written works — all protected by copyright from the moment of creation.
  • Design Rights: The visual appearance of products, interfaces or graphical works protected under registered or unregistered design rights.
  • Trademarks: Brand names, logos, service marks and trade dress that distinguish the organisation's products and services.
  • Patents: Inventions, technical processes and innovations protected by patent registration.
  • Source Code Licences: Open-source and proprietary code subject to specific licence conditions (e.g. GPL, MIT, Apache, commercial licences) that govern permitted uses, modifications and distribution.

Proprietary software is supplied under licence agreements that restrict use to specified machines and permit copying for backup purposes only. Data acquired from outside sources is obtained under data sharing agreements, with the provenance of the data clearly stated and documented.

Legal, regulatory and contractual restrictions apply to the copying of proprietary material. Only software and information products developed by the organisation or obtained under valid licences are used. Infringement of intellectual property rights can lead to fines and criminal proceedings. This policy also manages the risk of personnel and third parties failing to uphold the organisation's own intellectual property rights.

This policy applies to all personnel, contractors, consultants and third parties who access, use, develop, procure or manage software, data, creative works or other intellectual property on behalf of the organisation.

3. Software & Licence Compliance (A 5.32)

All software used across the organisation is subject to licence terms that define the permitted scope of use. Compliance with these terms is an active obligation — not an assumption. The following subsections define how software is acquired, licensed, monitored and retired in a manner that avoids infringement and demonstrates due diligence to auditors, regulators and rights holders.

3.1 Policy & Procedures

  • IPR Compliance Policy: This document constitutes the topic-specific policy on the protection of intellectual property rights. It defines the rules that govern how all forms of IP are used, managed and protected across the organisation. This policy is communicated to all personnel upon joining and is made available on the internal document portal at all times.
  • IPR Compliance Procedures: Documented procedures define what constitutes compliant use of software and information products. These procedures cover the acceptable use of commercial software (including cloud-delivered and subscription-based software), open-source components and third-party data. The procedures specify how licence terms are checked before use, how limits on copying or redistribution are observed, and how deviations are escalated. Personnel are required to read and follow the applicable procedure for any software or information product they use professionally.

3.2 Software Acquisition

  • Approved Acquisition Sources: Software is acquired exclusively through known and reputable sources — official vendor channels, established resellers or verified open-source repositories — to ensure that copyright is not infringed through the use of unauthorised, pirated or tampered copies. Procurement of software from unverified third parties, peer-to-peer networks, torrent sites or unofficial mirror sites is prohibited. The Information Security Officer or designated IT procurement function approves new software sources before purchase. All software acquisitions are logged in the software licence register to enable complete lifecycle tracking.

3.3 Licence Management

  • Proof of Ownership & Licence Evidence: Proof of ownership is retained for all licensed software and information products. This includes original licence agreements, purchase receipts, product keys, licence certificates, user manuals and entitlement documentation. Physical documents are stored securely; digital records are held in the software licence register. Proof of ownership is retained for the entire period of use and for a minimum retention period after disposal, to demonstrate compliance in the event of audit or legal challenge.
  • Licence Limits & Concurrent Use: The maximum number of users, devices, CPUs or virtual machines permitted under each licence is never exceeded. Before deploying additional instances or extending access, the current licence entitlement is checked against actual usage. Where usage approaches licence limits, a licence upgrade or additional entitlement is procured before the limit is reached. Licence metrics that restrict concurrent access or named-user counts are monitored continuously through the software licence register and periodic audits.
  • Software Audit & Compliance Reviews: Regular reviews are carried out to verify that only authorised software and licensed products are installed across organisational systems and endpoints. These reviews compare installed software against the software licence register and the approved software catalogue (see Acceptable Use Policy). Unauthorised software is removed promptly. Review results are documented and reported to the Information Security Officer. Reviews are conducted at least annually and after significant changes to the IT environment.
  • Licence Condition Maintenance: Procedures are in place to maintain compliance with licence conditions throughout the software lifecycle. When licence terms change — due to vendor updates, version upgrades or changes to subscription scope — the updated conditions are assessed and the software licence register is updated accordingly. Any condition that cannot be met triggers an escalation to management and, where necessary, discontinuation of use until a compliant arrangement is in place.

3.4 Software Disposal & Transfer

  • Software Disposal & Transfer: When software is decommissioned, uninstalled or transferred to another party, the disposal or transfer is carried out in accordance with the licence terms governing that specific product. Software that is not transferable under its licence is uninstalled and any associated licence keys or activation records are retired in the software licence register. Where licence terms permit transfer, the transfer is documented with the recipient's details, the date and the relevant licence identifiers. Personnel do not transfer or pass on software — including open-source tools and trial versions — without first verifying that the licence permits such transfer.

4. Information & Content Protection (A 5.32)

Beyond software licensing, intellectual property protection extends to the use of data, media content and published materials obtained from external sources. The terms under which such content is acquired or accessed impose binding restrictions on how it is used, reproduced, stored and distributed within the organisation.

4.1 External Data Sources

  • Terms & Conditions for External Sources: Before using software, datasets, APIs or information products obtained from public networks or outside sources — including open data portals, third-party APIs, commercial data providers and public-domain repositories — the applicable terms and conditions are reviewed and documented. Use is restricted to the scope permitted by those terms. Where terms require attribution, usage reporting or licensing fees, those obligations are fulfilled. Non-compliant use (e.g. using a dataset beyond the scope of a free-tier agreement, or scraping a website in violation of its terms of service) is prohibited.

4.2 Commercial Recordings

  • Commercial Audio & Video Recordings: Commercial recordings — including video productions, audio recordings, film content, music tracks and multimedia materials subject to copyright — are not duplicated, converted to another format or extracted in whole or in part, except where explicitly permitted by copyright law or by the applicable licence. Playing a commercial recording for internal training or business purposes does not confer the right to record, reformat or redistribute that content. Where specific uses (e.g. recording a training webinar that includes licensed music) require a licence, the appropriate licence is obtained before proceeding.

4.3 Published Materials

  • Standards, Books, Articles & Reports: Published materials — including technical standards (ISO, BSI, NIST, DIN), books, academic articles, industry reports, white papers, legal texts and press publications — are not copied in full or in part beyond what is permitted by copyright law or the specific licence under which they are accessed. Brief quotations with proper attribution are permissible where allowed by applicable fair use or quotation rights provisions. Subscriptions and site licences are used where systematic or organisational access to published materials is required. Personnel do not share full copies of purchased standards or publications with colleagues who are not covered by the same licence entitlement.

5. Asset Register & IPR Identification (A 5.32)

Effective IPR compliance depends on knowing which assets are subject to IP-related obligations. Assets that carry licensing conditions, copyright restrictions, data sharing terms or other IP-related requirements are identified and tracked so that compliance obligations can be monitored and discharged systematically.

5.1 IPR Asset Register

  • IPR-Relevant Asset Identification: All assets with requirements to protect intellectual property rights are identified in the asset inventory (see Asset Management). IPR-specific attributes — including the type of IP protection applicable (e.g. software licence, copyright, data sharing agreement, patent), the rights holder, key licence or contractual terms, relevant usage restrictions, and the expiry or renewal date — are recorded in the Software Licence Register, which is maintained as a dedicated register that references software and data assets from the asset inventory. The Software Licence Register captures all commercial software, open-source components and licensed data products and is reviewed and updated at least annually and whenever new IP-bearing assets are introduced or existing ones are retired.

6. Roles & Responsibilities

  • Top Management: Approves this policy, allocates resources for licence management and IPR compliance activities, and ensures that IPR obligations are integrated into procurement and planning processes.
  • Information Security Officer (ISO): Maintains this policy, oversees the software licence register, coordinates periodic compliance reviews, escalates IPR violations and ensures that identified legal, contractual and regulatory IPR requirements are documented in a structured overview that is kept current.
  • IT Procurement / IT Operations: Ensures that software is acquired exclusively from approved sources, records all software acquisitions in the software licence register, monitors licence limits and usage metrics, conducts scheduled software audits, and coordinates licence renewals and disposals.
  • Asset Owners: Identify IPR-relevant assets under their ownership, ensure the corresponding entries in the Software Licence Register are current, and notify IT Procurement when assets carrying licence or IP obligations are introduced, modified or retired.
  • Legal / Compliance: Maintains the legal register of applicable IP laws and regulations (see Legal Register), advises on the interpretation of specific licence terms, and reviews data sharing agreements and external content usage for compliance with applicable rights.
  • All Personnel: Use only authorised and licensed software and information products, refrain from unauthorised copying or redistribution of copyrighted materials, and report suspected IPR violations to the Information Security Officer without delay.

7. Review & Maintenance

This policy and the associated software licence register are reviewed:

  • At least annually, to verify that all licence terms, usage limits and IPR obligations remain current, and that the software audit findings are reflected in corrective actions.
  • When new legal or regulatory requirements affecting intellectual property are enacted or updated — including changes to copyright law, software licensing regulations, open-source compliance obligations or sector-specific IP requirements.
  • After any IPR-related incident, complaint or audit finding — including licence non-compliance notices from vendors, suspected copyright infringement or unauthorised use of the organisation's own IP.
  • When significant changes occur to the software portfolio, IT architecture or business processes that introduce new IP-bearing assets or alter existing licence obligations.
  • When new data sharing agreements or third-party content licences are entered into that introduce obligations not covered by current procedures.

Corrective actions identified through reviews or audits are documented, assigned to a responsible owner and tracked to resolution. Detected violations of licence terms or copyright restrictions are addressed promptly and, where required by law or contract, reported to the affected rights holder.

Sources

ISO 27001 Controls Covered

A.5.32 Intellectual property rights

Frequently asked questions

Is the Acceptable Use Policy enough for software compliance?

The Acceptable Use Policy governs which software employees may install. The IPR policy goes further: it defines how licences are procured, evidenced, monitored and disposed of — and it also covers open-source compliance, the organisation's own intellectual property and third-party content. The two documents complement each other.

Do I need a dedicated licence register?

Yes. ISO 27002 A 5.32 requires evidence of valid licences for all software products in use. A licence register documents the product, licence type, permitted installations, actual usage, expiry date and proof of ownership. Without this register, you have no evidence to present in an audit.

What do I need to watch for with open-source software?

Every open-source component is subject to a licence (GPL, MIT, Apache, etc.) that carries specific obligations — from attribution to source code disclosure. You need a current SBOM (Software Bill of Materials) and ideally an automated licence scanner that checks new dependencies before they reach production.

Who owns intellectual property created by employees during working hours?

In most jurisdictions, the organisation does (work-for-hire principle). Employment contracts should state this explicitly — including inventions, source code, designs and documentation. Without contractual clarity, grey areas emerge that become problematic when someone leaves.

How often should a software audit take place?

The policy recommends at least annually and after significant changes to the IT landscape. In practice, automated tools (software asset management, endpoint inventory) provide continuous data. The annual audit then becomes a validation of that data with spot checks.