ISO 27001 Control A.7.9: Security of Assets Off-Premises

The office walls stopped being the edge of your information a long time ago. Laptops travel in rucksacks, phones sit on café tables, a spare monitor lives in a spare bedroom, and a prototype device goes to a customer for a week. Each of these assets is outside every lock and camera you have installed. A.7.9 asks what you do about that. It is the ninth of 14 physical controls in our walk through Annex A.

The control is short, and that is its strength. It does not tell you to ban off-site work, which would be unrealistic. It asks you to make sure that when assets leave the building, the protection leaves with them.

What the control requires

Annex A control 7.9 of ISO 27001:2022 states that off-site assets shall be protected.

The key elements:

• Off-site assets - anything the organization owns or is responsible for that is used outside its premises, such as laptops, phones, tablets, storage devices, paper files and specialist equipment
• Protected - using measures that match the risk of the location, since a hotel room, a train and a home office each present different threats
• Wherever they go - the protection should address transport, use and storage away from the organization’s own sites

A.7.9 is a preventive control in ISO/IEC 27002:2022. Annex A states the control; ISO 27002 offers the guidance, which includes keeping equipment and media taken off-site unattended in public places as little as possible, following manufacturer instructions for protecting equipment, and keeping a log of the chain of custody for equipment moved between people and organizations. It also raises the point that risks differ by location, so the controls should be chosen on that basis. This control is about physical protection. The wider topic of working away from the office lives in remote working and in the technical device controls later in the series.

How to implement security of off-site assets

Know what is out there

You cannot protect what you cannot list. Start from your asset inventory and mark which items leave the premises, who has them, and for how long. Many organizations find that the list is longer than expected: demo kits, test phones, spare laptops, development boards, USB drives, and printed material taken to meetings. Use a simple sign-out record for items that move occasionally, and assign a named holder to anything that lives off-site. When a device goes missing, you want the answer to “who had it, and what was on it?” within minutes, not days.

Decide at the same time what is allowed. A simple rule that says which equipment may be taken out, who authorizes it, and what conditions apply is better than a blanket ban that people quietly ignore.

Set practical rules for carrying and using assets

Give people short, concrete guidance for the places they actually go:

• Keep equipment with you in public places and when travelling; never leave it visible in a parked car
• Use hand luggage rather than checked bags for laptops and storage media
• Avoid using sensitive documents or screens where others can watch, which echoes the thinking behind clear desk and clear screen
• Lock devices when you step away, and use privacy filters in crowded spaces
• Do not lend devices to friends or family, even for a moment
• Report loss or theft immediately, without fear of blame

That last rule matters most. Time between loss and report is when most of the damage happens, so make reporting easy and welcome. Staff should know whom to contact and how, which ties directly to information security event reporting.

Use technical safeguards that make loss survivable

Physical care will fail sometimes. A lost laptop should be an inconvenience, not an incident. Full-disk encryption, strong authentication, automatic screen lock, and the ability to locate, lock or wipe a device remotely turn a stolen asset into a replacement order rather than a breach notification. Those are covered more fully in later technological controls, but they belong in the plan here because they decide what a thief can actually reach.

Where travel is to higher-risk destinations, consider issuing clean loan devices with minimal data and checking the equipment on return. For assets that must remain in the field, such as equipment installed at a customer site, agree who is responsible for its physical protection and put it in the contract.

Cover home offices, third parties and the return journey

When assets are used at home, expect the physical environment to be less controlled than yours. A lockable cupboard, a rule against sharing devices with household members, and guidance on where to work help a great deal. Our post on remote working goes further into what the home setup needs.

Equipment also goes to third parties: repair shops, customers, couriers. Record what is sent, to whom, and by what route, and ask for confirmation of receipt. Where a supplier keeps your equipment for a time, agree their security duties in writing, and make sure staff leaving the organization hand everything back. The people side of that is covered in responsibilities after termination or change of employment.

Review the arrangement from time to time

Off-site risk changes with the way people work. A new customer in another country, a team that starts travelling weekly, or a switch to more home working all shift the picture. Revisit the rules at least annually, look at the lost-and-stolen record for patterns, and ask the people who travel what is awkward about the rules. If a rule is awkward, it is being broken somewhere, and the fix is usually small. Feed what you learn into your regular risk assessment so that off-site risks are rated alongside everything else.

Related controls and clauses

A.7.7 connection. Clear desk and clear screen rules apply wherever people work, including trains, cafes and kitchen tables.

A.7.8 connection. Equipment siting and protection covers placement inside your premises; this control picks up where the premises end.

A.6.7 connection. Remote working sets the wider expectations for staff working from home or on the move.

A.6.5 connection. Responsibilities after termination or change of employment is how off-site assets come back when someone leaves.

A.6.8 connection. Information security event reporting is the route for reporting a lost or stolen device.

Forward reference. Storage media (A.7.10) and Secure disposal or re-use of equipment (A.7.14) follow in the series and deal with the data on devices throughout their life, and the later technological control on user endpoint devices (A.8.1) covers the technical side of keeping devices safe.

What auditors check

An inventory that shows off-site items. Auditors look for a record of which assets are held away from the premises and by whom.

Rules and awareness. They read the guidance for travelling and remote use, then ask staff what they would do if a laptop were stolen from a car.

Loss and theft handling. Expect questions about past incidents, how fast they were reported and what was done. Records of loss events with sensible responses are reassuring, not alarming.

Technical protection on devices. Auditors may sample laptops or phones for disk encryption and lock settings, and ask how remote wipe works.

Return of assets. Leaver records showing that equipment was recovered are common evidence.

Third-party handling. Where equipment travels to repairers or customers, they look for records and contractual terms.

Common mistakes to avoid

Assuming only laptops count. Phones, USB sticks, paper files, tokens and development kits all leave the building. Your inventory should include them.

No sign-out process for shared kit. Demo devices and loan laptops circulate without owners, and nobody knows who last held them.

Rules that ban reality. A rule that forbids anything off-site is ignored. Allow it, with conditions.

Late reporting. Staff afraid of blame report days after a loss. Make it plain that quick reporting is always the right thing.

Encryption assumed but unchecked. Never rely on a belief that devices are encrypted. Check by sampling.

Forgetting equipment held by suppliers. A device sitting at a repair centre is still your asset, and the agreement should say how it is protected.

No return routine for leavers. If equipment recovery depends on someone remembering, some of it will walk.

How 27kay can help

We help organizations make off-site protection realistic for how teams actually work, from sign-out routines and travel guidance to the technical safeguards that make a lost device a small problem. As part of ISO 27001 implementation, we review your inventory, shape practical rules with your people and prepare the evidence auditors ask for. For the full picture, see our ISO 27001 knowledge hub.

If a laptop left your team’s hands on the train home tonight, how quickly would you know, and what could a stranger reach? Get in touch - we will help you make the honest answer a comfortable one.