ISO 27001 A.7.9 - Security of Assets Off-Premises

Requirement

“Off-site assets shall be protected.”

Plain-language meaning

The organization should protect equipment, documents, data, software, and storage media when they leave the organization’s controlled environment.

Off-premises work creates flexibility, but it weakens the normal physical protections around information. Laptops, paper files, removable media, mobile devices, and BYOD devices can be lost, stolen, viewed, copied, damaged, or accessed in locations the organization does not control.

Why this matters

An asset outside the office can still contain or access organizational information. A stolen laptop, forgotten paper file, lost USB drive, or unmanaged BYOD device can become a confidentiality breach, availability issue, regulatory event, or evidence gap.

The main ISMS question is not “can people work remotely?” It is “what assets leave, who is responsible, what protection applies, and has management accepted any residual off-site risk?”

Implementation guidance

1. Define the off-premises asset policy

The organization should decide which approach applies:

Uncontrolled removal of sensitive information is risky. If the organization accepts higher off-site risk, the acceptance should be explicit, reviewed, and approved by the right level of management.

2. Require formal authorization

Equipment, information, software, and media should not be taken or transmitted off-site without authorization.

Authorization should define:

• what asset may leave;
• who may carry or use it;
• purpose and duration;
• permitted locations;
• required controls;
• return or review date;
• additional jurisdiction or border requirements where relevant.

3. Keep accountability for assets

The organization should know where assets are and who is responsible for them.

Controls may include:

• asset registers;
• ownership labels where practical;
• booking-out and return records;
• long-term loan attestation;
• periodic possession checks;
• leaver asset return process;
• secure erase before staff keep or buy equipment.

4. Protect mobile and portable assets

Controls should match the sensitivity of the information and the likelihood of loss or theft.

Examples:

• full-disk encryption;
• strong authentication;
• screen locking;
• remote wipe or device management;
• secure transport bags;
• no unattended laptops in vehicles or public places;
• privacy screens;
• rules for paper files and removable media;
• incident reporting for loss or theft.

5. Address BYOD and jurisdiction risk

BYOD complicates control because the organization may not own the device, but may still own or be responsible for the information accessed from it.

When assets or access cross jurisdictions, consider whether local laws, inspection powers, or data-access requirements change the risk profile.

6. Link to insurance and risk acceptance

Insurance may be relevant for organization-owned equipment off-premises, but it is not a security control by itself. Check policy conditions, excess, and whether the organization must meet specific protection requirements before a claim is valid.

If equivalent off-site protection is impossible or impractical, top management should make an informed decision about whether to tolerate the increased risk.

Audit guidance

Auditors should verify:

• off-premises asset risk assessment;
• policy and procedures for asset removal;
• authorization records;
• booking-out/return records;
• long-term loan attestations;
• BYOD controls where applicable;
• mobile equipment protection controls;
• leaver asset return records;
• secure erase records for retained or purchased devices;
• insurance conditions where relevant;
• management risk acceptance where off-site protection is weaker than on-site protection.

Auditors should test whether off-site security is comparable with on-site protection or whether the residual difference has been accepted by an appropriate role.

Evidence examples

Strong evidence

• Off-premises risks are assessed and reviewed.
• Asset removal requires authorization and is logged.
• Long-term off-site assets are periodically attested.
• Mobile devices use appropriate technical controls.
• BYOD access is governed and controlled.
• Leaver processes recover assets or erase information.
• Risk acceptance is approved when off-site protection is weaker than on-site protection.

Weak evidence

• Staff can take assets home without logging or authorization.
• Asset inventory does not show off-site location or custodian.
• BYOD is allowed informally.
• No periodic check confirms long-term loan assets still exist.
• Leavers are trusted to return equipment without evidence.
• Insurance exists but conditions are not understood.
• Management has not accepted the increased off-site risk.

Common failures

Exam traps

Related controls and concepts

• A.7 Physical Controls MOC
• A.6.7 Remote Working
• A.7.8 Equipment Siting and Protection
• A.5.9 Inventory of Information and Other Associated Assets
• A.5.10 Acceptable Use of Information and Other Associated Assets
• A.5.11 Return of Assets
• A.5.12 Classification of Information
• A.5.15 Access Control
• A.5.18 Access Rights
• Risk Assessment
• Statement of Applicability
• Off-Premises Asset Authorization Register
• Off-Premises Asset Protection Checklist
• Long-Term Asset Loan Attestation
• A.7.9 Audit Evidence Pack
• A.7.9 Audit Checklist

KB-ready summary

• Decide what can leave and what cannot.
• Authorize and log asset removal.
• Protect portable and mobile assets.
• Include BYOD and remote equipment in scope.
• Periodically confirm long-term off-site assets.
• Recover or securely erase assets during leaver processes.

Templates and checklists

• Off-Premises Asset Authorization Register
• Off-Premises Asset Protection Checklist
• Long-Term Asset Loan Attestation
• A.7.9 Audit Checklist