Skip to content
Organisational controls
ISO 27001A.5.11

ISO 27001 Annex A 5.11 Return of organisation's assets upon departure

What it says

Personnel and other interested parties as appropriate shall return all the organization's assets in their possession upon change or termination of their employment, contract or agreement.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Ensure that employees and external parties return all company assets when their job or contract ends.

When someone leaves the company or ends their contract, they need to give back everything that belongs to the company, like laptops and keys. This is important because if people keep company stuff, they might accidentally or intentionally lose critical information or misuse assets, which can cause serious harm to the business.

Why it matters

Without a structured asset return process, ex-employees may retain access, risking data breaches or misuse of organisational resources.

How to implement

  1. The HR manager should ensure that the departure process includes steps for returning all company assets.

    This can be done by creating a checklist for employees to follow when they leave, which includes items like laptops, door keys, and documents.

  2. IT managers need to track all electronic assets given to employees, such as computers and phones.

    They can use an asset management system that logs devices to specific employees, making it easier to know what needs to be returned.

  3. Office managers should manage the return of physical assets like office keys and security cards as part of the exit procedure.

    They should document who has which items and schedule a time when the departing employee can return them.

  4. Security personnel should monitor data access during an employee's notice period to prevent unauthorised copying of sensitive information.

    Implementing monitoring tools can help detect and block any unusual data access.

  5. Senior management should ensure knowledge from departing employees is documented and transferred.

    This involves arranging exit interviews where the employee can pass on crucial information about their role and projects to remaining team members.

Keep it running

Embed asset return and access revocation in HR/IT/facilities offboarding checklists; confirm return of devices, badges, keys and tokens before exit.

Evidence and audit

  1. Check 1 of 2What an auditor asks for

    Ask for

    The exit procedure documentation.

    Look at

    The sections about asset tracking and returns. Good documentation will detail specific steps for collecting each type of asset.

    Good evidence

    System will show clear records of what assets each person had and their return status.

  2. Check 2 of 2What an auditor asks for

    Ask for

    Records of exit interviews or similar knowledge transfer sessions. Review how often these are conducted and what information is typically gathered. A well-documented process will demonstrate consistent collection and transfer of crucial knowledge.

    Look at

    Any alerts or actions taken in response to data access attempts. A robust report will highlight potential breaches and remedial actions taken.

Mappings

Closest match in ASD Information Security Manual: ISM-0430, Same-day removal or suspension of access no longer required, which partially overlaps with this control.

ASD ISM

ASD Information Security Manual: 1 mapping

  • ISM-0430Same-day removal or suspension of access no longer requiredPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.

Get help with this control

ISO 27001 training

Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.