1. Training Objective
This training explains how employees and authorized users should safely share organizational information internally and externally.
By the end of the training, users should understand:
- What information they are handling.
- How to classify it.
- Who is authorized to receive it.
- Which transfer channel to use.
- What security controls are required.
- What to do if information is sent incorrectly.
Golden Rule
Right Information → Right Person → Right Purpose → Right Channel → Right Protection
2. What Is Information Transfer?
Information transfer includes any activity where organizational information is sent, shared, uploaded, transmitted, or made accessible to another person or system.
Examples:
- Email attachments
- Cloud-sharing links
- Customer portals
- SFTP
- APIs
- Source-code repositories
- Collaboration platforms
- Messaging applications
- USB/removable media
- Physical documents
- Remote access
- AI platforms
Giving someone access to a file is also information sharing.
3. Why Does Secure Transfer Matter?
A security incident can happen even when the underlying system is secure.
Examples:
- Sending a file to the wrong email address.
- Sharing a public cloud link.
- Uploading customer data to an unauthorized AI service.
- Sending credentials through chat.
- Giving a supplier access longer than necessary.
- Using personal email to transfer company files.
Remember
A secure system does not make an insecure transfer safe.
4. Information Classification
Before transferring information, identify its classification.
| Classification | Example | Transfer Approach |
|---|---|---|
| Public | Published website content | Approved public/business channels |
| Internal | Internal procedures | Authorized corporate channels |
| Confidential | Customer data, contracts, security reports | Secure controlled transfer |
| Restricted | Passwords, API keys, production credentials | Explicit approval + restricted mechanism |
Always follow the organization’s Information Classification Policy.
5. The Five Questions
Before sharing information, ask:
1. WHAT?
What exactly am I sending?
2. WHY?
Why does the recipient need it?
3. WHO?
Who will receive or access it?
4. HOW?
Which approved channel should be used?
5. PROTECTION?
What security controls are required?
6. The Secure Transfer Process
Use this simple process:
IDENTIFY
↓
CLASSIFY
↓
CONFIRM PURPOSE
↓
VERIFY RECIPIENT
↓
MINIMIZE DATA
↓
SELECT APPROVED CHANNEL
↓
PROTECT
↓
TRANSFER
↓
CONFIRM RECEIPT
↓
REMOVE ACCESS
↓
RECORD / REPORT
7. Verify the Recipient
Always verify:
- Name
- Email address
- Organization
- Role
- Business relationship
- Authorization
- Need-to-know
Example
You intend to send a report to:
john@customer.com
Autocomplete selects:
john@customer-support.com
STOP.
Do not rely only on autocomplete. Verify the recipient.
8. Data Minimization
Send only what the recipient needs.
❌ Poor Practice
Send the entire customer database to troubleshoot one customer issue.
✅ Better Practice
Send only:
- Required customer record
- Relevant ticket
- Required technical information
- Sanitized logs
Remove unnecessary:
- Personal data
- Customer records
- Credentials
- Internal information
- Security configuration
9. Approved Transfer Channels
Use organization-approved channels such as:
- Corporate email
- Secure file-sharing
- Customer portal
- SFTP
- Approved cloud storage
- Authenticated APIs
- Approved source-code repositories
- Approved collaboration platforms
- Enterprise secrets-management systems
The appropriate channel depends on the information classification and risk.
10. Channels to Avoid
Do not use:
- Personal email
- Personal cloud storage
- Public file-sharing links
- Unapproved messaging applications
- Unapproved AI tools
- Public repositories
- Unencrypted USB devices
- Personal storage accounts
unless there is a formally approved exception.
11. Email Safety
Before sending a sensitive email:
- Check the To field.
- Check CC/BCC.
- Check the attachment.
- Check classification.
- Confirm the recipient.
- Confirm authorization.
- Use encryption where required.
- Use secure file sharing where more appropriate.
Important
Never send a password in the same email as a password-protected file.
12. Confidential Information
Examples:
- Customer information
- Contracts
- Employee information
- Financial information
- Source code
- Security reports
- Audit evidence
- Architecture documents
Before sharing:
Verify → Authorize → Minimize → Protect → Transfer → Confirm
13. Restricted Information
Examples:
- Passwords
- API keys
- Production credentials
- Private keys
- Encryption keys
- Highly sensitive vulnerability information
- Critical security configurations
Never:
- Put credentials in email.
- Put secrets in spreadsheets.
- Put production credentials in source code.
- Share private keys through chat.
- Upload Restricted information to an unapproved AI tool.
Use an approved secrets-management or restricted transfer mechanism.
14. Customer Data
Before sharing customer data:
- Confirm the business purpose.
- Confirm contractual authorization.
- Verify the recipient.
- Minimize the data.
- Use the approved channel.
- Apply customer-specific requirements.
- Retain evidence where required.
15. Personal Data
Personal data may include:
- Name
- Email address
- Phone number
- Employee information
- Customer account information
- Identification information
Before transferring personal data:
Purpose → Necessity → Recipient → Legal/Contractual Requirements → Protection
When uncertain, consult Privacy/Legal.
16. Third-Party Sharing
Before sending information to a supplier, consultant, auditor, or business partner:
Business Need → Recipient Verification → Classification → Contract Check → Approval → Secure Transfer
Only the information necessary for the agreed purpose should be shared.
17. Cloud-Sharing Safety
Before creating a sharing link:
- Correct file?
- Correct recipient?
- Correct permissions?
- Authentication enabled?
- MFA where appropriate?
- Expiry configured?
- Public access disabled?
- Download restrictions considered?
Avoid:
Anyone with the link can access
for Confidential or Restricted information.
18. Source Code
Use only approved source-code repositories.
Before sharing source code:
- Verify recipient.
- Check repository permissions.
- Remove secrets.
- Remove API keys.
- Remove production credentials.
- Check third-party code/licensing requirements.
- Use approved external collaborator access where required.
19. AI Tools
AI platforms can be external information-processing services.
Before submitting organizational information:
- Is the tool approved?
- Is the use case approved?
- What is the classification?
- Does it contain customer information?
- Does it contain personal data?
- Does the provider retain the information?
- Can information be used for model training?
- Are contractual/privacy requirements satisfied?
Never submit to an unapproved AI service:
- Passwords
- API keys
- Production credentials
- Confidential customer information
- Restricted security information
- Sensitive incident information
20. Remote Working
When working remotely:
- Use approved corporate systems.
- Do not use personal accounts for company information.
- Avoid public computers.
- Protect your screen.
- Do not leave confidential documents unattended.
- Verify recipients before sharing.
- Report lost devices or documents immediately.
21. Accidental Transfer
If you send information to the wrong person:
Do not hide it.
Immediately:
STOP → REPORT → RESTRICT → ASSESS → REMEDIATE
- Stop further sharing.
- Revoke access where possible.
- Notify Security/ISMS or the designated reporting contact.
- Identify the information exposed.
- Identify the recipient.
- Preserve evidence.
- Support impact assessment.
- Follow the incident/breach procedure.
22. Scenario 1 – Wrong Attachment
You are sending a customer report to an auditor.
You accidentally attach an internal employee spreadsheet.
What should you do?
A. Ignore it because the auditor is trusted.
B. Send the correct report in another email.
C. Immediately report the incident and follow the organization’s incident process.
D. Delete the email from your Sent folder.
Correct Answer: C
Deleting your own Sent email does not remove the recipient’s copy.
23. Scenario 2 – Customer Database
A supplier asks for the complete customer database to troubleshoot an application problem.
What should you do?
A. Send it immediately.
B. Upload it to personal Google Drive.
C. Confirm the purpose, minimize the data, verify authorization, and use an approved secure channel.
D. Send it through WhatsApp.
Correct Answer: C
24. Scenario 3 – API Key
A developer needs to give an external consultant an API key.
What should be used?
A. Email
B. Excel
C. Chat
D. Approved secrets-management mechanism
Correct Answer: D
25. Scenario 4 – Cloud Link
You need to send a Confidential document to an external auditor.
Which is preferable?
A. Public link
B. “Anyone with the link”
C. Named recipient with authentication and expiry
D. Personal cloud storage
Correct Answer: C
26. Scenario 5 – AI Tool
An employee wants to paste a customer’s confidential incident report into a free AI website to summarize it.
What should happen?
STOP.
The employee should verify whether the AI tool and use case are approved and whether the information may be processed by that service.
If not approved, the information must not be submitted.
27. AWS SaaS Example
A SaaS company needs to provide security evidence to an external auditor.
Information
- AWS architecture diagram
- Vulnerability report
- Access review
- Security policies
- Incident records
Secure Process
Classify
↓
Confirm Auditor
↓
Confirm Audit Scope
↓
Obtain Approval
↓
Upload to Approved Repository
↓
Named User + MFA
↓
Read-Only Access
↓
Set Expiry
↓
Confirm Receipt
↓
Revoke Access After Audit
28. The STOP–CHECK–VERIFY Rule
When uncertain:
STOP
Do not send immediately.
CHECK
Check classification, purpose, and recipient.
VERIFY
Confirm authorization and approved transfer channel.
THEN SEND
Apply the required protection.
29. Quick Reference
Before Sending
IDENTIFY
- What am I sending?
CLASSIFY
- How sensitive is it?
VERIFY
- Who receives it?
MINIMIZE
- Do they need everything?
AUTHORIZE
- Am I allowed to share it?
PROTECT
- What controls are required?
SEND
- Am I using an approved channel?
After Sending
CONFIRM
- Was it received by the right person?
REVOKE
- Does temporary access need to be removed?
RECORD
- Is evidence required?
REPORT
- Did anything go wrong?
30. Knowledge Assessment
Q1. What should you do before transferring customer data?
A. Send it immediately
B. Confirm purpose, authorization, recipient, classification, and minimum required data
C. Upload it to personal storage
D. Send the complete database
Answer: B
Q2. Is personal email an approved transfer channel?
A. Always
B. For Confidential information
C. Only when formally authorized through an approved exception
D. Whenever company email is unavailable
Answer: C
Q3. Where should production API keys normally be stored or transferred?
A. Email
B. Spreadsheet
C. Approved secrets-management mechanism
D. Chat
Answer: C
Q4. What should you do after sending a Confidential file through a temporary sharing link?
A. Leave the link active permanently
B. Remove access when the business need ends
C. Publish the link
D. Send the link to additional people
Answer: B
Q5. What should you do after sending information to the wrong recipient?
A. Ignore it
B. Delete the Sent email
C. Report it immediately and follow the incident process
D. Wait to see what happens
Answer: C
31. Training Completion
| Field | Details |
|---|---|
| Employee Name | [Name] |
| Employee ID | [ID] |
| Department | [Department] |
| Training Date | [Date] |
| Trainer | [Name] |
| Assessment Score | [Score] |
| Result | Pass / Fail |
| Employee Acknowledgement | Yes / No |
| Next Training Date | [Date] |
32. Training Effectiveness
Effectiveness may be measured through:
- Knowledge-test results
- Phishing simulations
- Wrong-recipient incidents
- Data-transfer incidents
- Policy violations
- Internal audit findings
- User feedback
- Incident trends
- Corrective actions
Repeated transfer mistakes should trigger additional awareness or process improvements.
33. Suggested Training Frequency
| Training | Timing |
|---|---|
| New Joiner Training | During onboarding |
| General Refresher | Annually |
| Awareness Topic | Monthly/Quarterly |
| Role-Based Training | As required |
| Post-Incident Training | After significant incidents |
| Policy Change Training | When material changes occur |
These are practical organizational examples, not universal ISO requirements.
34. Training Evidence
Maintain appropriate evidence such as:
- Training material
- Attendance/completion records
- Assessment results
- Employee acknowledgement
- Awareness campaigns
- Phishing simulation results
- Role-based training
- Incident-related awareness
- Effectiveness measurements
- Improvement actions
35. Related ISMS Documents
This training supports:
- Information Security Policy
- Information Classification Policy
- Information Transfer Policy
- Approved Information Transfer Channels
- Secure Information Transfer Procedure
- Secure File Transfer Checklist
- External Data Sharing Procedure
- Third-Party Information Sharing Agreement
- Data Handling Guidelines
- Information Handling Procedure
- Access Control Policy
- AI Acceptable Use Policy
- Incident Response Plan
- Data Breach Response Procedure
36. ISO 27001 Connection
This training supports applicable requirements relating to:
- Information security awareness
- Information transfer
- Information classification
- Access control
- Data protection
- Supplier security
- Incident reporting
- Protection of organizational information
The exact applicable controls should be determined through the organization’s risk assessment and Statement of Applicability (SoA).
37. Final Takeaway
Remember:
STOP → CHECK → VERIFY → MINIMIZE → PROTECT → SEND → CONFIRM → REPORT
STOP before sharing sensitive information.
CHECK the classification and purpose.
VERIFY the recipient and authorization.
MINIMIZE the information.
PROTECT it using the appropriate controls.
SEND through an approved channel.
CONFIRM receipt and remove temporary access.
REPORT immediately if something goes wrong.
Final Principle
Secure information transfer is everyone’s responsibility. Before sharing information, make sure it goes to the right person, for the right purpose, through the right channel, with the right protection.