Security of assets off-premises

Plain-language summary

Protecting laptops, phones, media, documents and other assets once they leave your sites — taken home, carried on business trips, left at a customer, sent for repair — with authorisation, tracking and handling rules suited to the risks outside your walls.

What the clause is really asking

Assets outside your premises face theft, loss, damage and inspection that the office does not, and this control asks you to protect them. That includes devices used by remote workers, equipment taken to customer or supplier sites, devices and media in transit, and assets sent out for repair or stored offsite. Typical measures: authorising removal of equipment where the risk warrants it; keeping a record of who has what and where; not leaving devices unattended in public places or vehicles; following manufacturers' guidance on physical protection; encrypting devices and media; and procedures for loss or theft, including legal requirements when crossing borders. The misunderstanding is that the asset register covers it; auditors want to know what happens once an asset leaves the building. In South Africa theft from vehicles and smash-and-grab are common, so the rule never to leave a laptop visible in a car, and to put it in the boot before setting off rather than on arrival, is worth writing down. Equipment held at an outsourced site, such as a tooling supplier, counts too.

What auditors look for

Auditors ask for the rules for taking assets off-site and the record of who holds which mobile assets. They sample assets from the register and ask to see them or proof of where they are. They ask for the encryption status of laptops and removable media. They review lost and stolen device reports and trace one through remote wipe, police case number, POPIA assessment and replacement. They ask how equipment sent for repair is tracked and whether data is removed first. The hard question: how many laptops did you lose last year, and were they all encrypted?

Typical evidence

Off-premises rules within the remote working or acceptable use policy; asset register showing assigned user and location; removal authorisations where required; encryption compliance reports; loss and theft reports with remote wipe and response records; log of equipment sent for repair or stored offsite; travel security guidance for staff.

How to comply — recommendations

Put a short section on assets off-premises into the acceptable use or remote working policy: keep devices with you or locked away, never visible in a car, report a loss within the hour. Make sure every laptop and phone is assigned to a named user in the asset register and is encrypted and remotely wipeable. Keep a simple log for equipment taken to customer sites or sent for repair, with data removed or encrypted before it goes. Brief travelling staff, especially before international trips. Review loss reports quarterly and look for patterns.

Common nonconformities

Laptops not encrypted; no record of who holds mobile devices; lost devices not reported or not wiped; equipment sent for repair with data intact and no tracking; staff leaving devices in vehicles; no rules for assets at customer or supplier sites; removal of equipment from site uncontrolled.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.