ISO 27001 Control A.5.11: Return of Assets

When someone leaves, the visible things are easy to remember: the laptop, the phone, the building pass. The less visible things are the ones that cause trouble. The files on a personal cloud drive. The company data on a home printer. The shared password in a notebook. The contractor whose access was never switched off after the project ended. A.5.11 asks you to make sure everything that belongs to the organization comes back when a person’s relationship with it changes or ends. It is the eleventh of 37 organizational controls in Annex A.

The control is about more than employees. Contractors, consultants, interns, suppliers’ staff and other interested parties may hold your assets too. And it is about change as well as departure: a person moving to a new role may need to return equipment or access they no longer require.

What the control requires

Annex A control 5.11 of ISO 27001:2022 states that personnel and other interested parties as appropriate shall return all the organization’s assets in their possession upon change or termination of their employment, contract or agreement.

The key elements:

Personnel and other interested parties as appropriate - employees, contractors, temporary staff, suppliers and others who have been given assets
All the organization’s assets in their possession - physical items, digital information, credentials and tokens, not only the obvious hardware
Change or termination - triggered when employment, contract or agreement ends or when circumstances change
Shall return - a defined, followed process with confirmation

A.5.11 is a preventive control in ISO/IEC 27002:2022. It prevents assets and the information they hold from leaving the organization’s control unnoticed. Annex A states the control; ISO 27002 gives guidance, including that the change or termination process should be formalized and include the return of previously issued physical and electronic assets owned by or entrusted to the organization. It also covers cases where personnel use their own equipment, which we address below.

How to implement return of assets

Know what each person holds

You cannot ask for the return of something you never recorded. Your inventory of information and other associated assets should show who holds which devices, accounts, tokens and keys, and a leaver should be checked against it. Typical categories include:

Laptops, phones, tablets and peripherals
Access cards, keys and tokens, including those used to enter working in secure areas
Removable media and printed documents, linked to storage media
Software licenses and accounts
Credentials such as shared passwords, API keys and certificates
Information in personal accounts or on personal devices
Equipment used outside the office, as described in security of assets off-premises

Keeping this knowledge up to date during employment is far easier than reconstructing it on the final day.

Build the process into leaving and moving

Create a simple, repeatable checklist owned jointly by HR, IT and the person’s manager. A strong checklist covers:

Notification to IT and facilities as soon as the departure date is known
A handover list of assets with the date and place of return
Collection of physical items, with a signed receipt
Removal or transfer of access on the agreed date, and earlier where the situation calls for it
Transfer of knowledge and files to colleagues, so important information does not leave in someone’s head or on their device
Retrieval or deletion of company information held on personal devices or accounts
Confirmation by the manager that the process is complete

Timing matters. For a friendly resignation the access might remain until the last day. For a dismissal or a suspected risk, access should be removed at the moment the person is informed. Decide in advance who may order an urgent removal. The same checklist should apply, in lighter form, when someone changes roles, so that old permissions and equipment do not accumulate.

Handle personal devices and accounts

If your organization allows personal devices for work, the return of assets includes the information on them. ISO 27002 guidance anticipates this: where personnel use their own equipment, procedures should ensure relevant information is transferred to the organization and securely erased from the device. Use technical measures where you can, such as separating work data in a managed container so it can be removed remotely, and rely on written agreements where you cannot. Be clear in your policy about what you will and will not do to personal devices, and take legal advice on remote wiping and monitoring, because privacy and employment rules differ between countries. Remote working arrangements, discussed in remote working, often increase the number of items that are away from the office, so plan for shipping, collection and verification.

Cover contractors and suppliers

Agreements with contractors and suppliers should state what assets they receive and when and how they must return them. Name a person on your side who confirms the return and closes the access. Do not rely on the supplier to tell you when their staff change; many supplier problems start with a former contractor whose account remained active for months. This ties into terms and conditions of employment for staff and the agreements you use with third parties.

Preserve knowledge and deal with what you get back

Returned devices should be checked for damage, wiped and reissued or retired through proper channels, following secure disposal or re-use of equipment. Consider whether the device or its data must be preserved first, for example during an investigation. Also record anything that has not been returned, escalate it, and decide on follow-up, remembering that ongoing duties such as confidentiality survive the end of employment, as explained in responsibilities after termination or change of employment.

Make the exit a good experience

A leaver process works best when it is respectful. People who feel treated fairly on their way out hand things back promptly and are more willing to help with handover, while those who feel ambushed tend to delay. A short, friendly exit conversation covering what has to come back, what happens to their accounts and which confidentiality duties continue is more effective than a surprise email from IT. It also gives you a chance to ask what they think could be improved, which feeds the wider improvement work in your ISMS.

A.5.9 connection. Inventory of information and other associated assets tells you what should come back.

A.5.10 connection. Acceptable use of information and other associated assets defines how assets may be used while in someone’s hands.

A.6.2 connection. Terms and conditions of employment is where the duty to return assets is usually recorded.

A.6.5 connection. Responsibilities after termination or change of employment covers duties that continue after the person has left.

A.7.9 connection. Security of assets off-premises describes protection of equipment that is away from your sites.

A.7.14 connection. Secure disposal or re-use of equipment governs what happens to returned hardware.

Forward reference. Access rights, covered later in the series, deals with removing and adjusting permissions, which goes hand in hand with returning physical and digital assets.

What auditors check

A documented process. Auditors expect a leaver and mover procedure that includes asset return, and ask which teams are involved.

Samples of recent leavers. They select a few people who left recently and ask for the completed checklist, receipts for returned equipment and evidence that access was removed.

Reconciliation with the inventory. Assets held by departed staff should not still appear as assigned to them.

Contractors and suppliers. They check that third parties are covered, not only employees.

Personal devices. If personal devices are used, auditors look for the agreed method of removing company data.

Timeliness. Dates matter: access removed weeks after departure is a typical finding.

Common mistakes to avoid

Hardware only. Credentials, shared accounts and data in personal storage are often more dangerous than a missing laptop.

HR owns it alone. Without IT and facilities involved, accounts and keys stay active.

No trigger for role changes. People who move teams collect devices and access over the years.

Ignoring remote staff. A laptop at a home address needs a plan for collection and verification.

Forgetting contractors. Project-based access is rarely reviewed unless someone owns it.

No record of non-returns. If an item is missing, the decision to chase, write off or investigate should be documented.

How 27kay can help

We help organizations build joiner, mover and leaver routines that are short enough to follow and complete enough to satisfy an auditor, joining HR, IT and facilities into one checklist. As part of ISO 27001 implementation, we also help you handle personal devices and contractors sensibly. For the full picture, see our ISO 27001 knowledge hub.

If a colleague resigned tonight, would you know everything they hold that belongs to the organization? Get in touch - we will help you make sure the answer is yes.