What it asks for. Put in place rules, procedures or agreements for every kind of information transfer, within the organisation and with outside parties, covering electronic, physical and verbal transfer.
In practice. Identify the channels people actually use, such as email, file sharing platforms, APIs, removable media, couriers and phone calls, and set expectations for each by classification: encryption, approved tools, recipient verification and labelling. Transfers with external parties are underpinned by agreements that state security responsibilities, and sensitive conversations in public places or on unsecured lines are covered in guidance. Auditors look for the transfer policy, contractual clauses with key partners, technical controls such as TLS enforcement or data loss prevention, and records of exceptions.
Common gaps. Organisations often address email but ignore shadow file sharing, messaging apps and machine to machine integrations. Verbal and physical transfers are frequently forgotten, and agreements with partners rarely spell out who protects data in transit.