ISO 27001 Annex A 7.9 Security of off-site assets
What it says
Off-site assets shall be protected.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure assets used outside the office are protected from theft or loss.
This control is about making sure that any company devices used outside the work premises, like laptops or phones, are protected from being lost, stolen, or damaged. It matters because if these devices are not secure, sensitive company information could fall into the wrong hands or be lost, which could lead to financial loss or damage to the company's reputation.
Free. Save your status, tasks and notes.
Why it matters
Lost or stolen off-site assets can lead to significant data breaches, risking sensitive data exposure and financial loss.
How to implement
The IT manager should develop a policy stating how company devices should be used and secured when taken off-premises.
This includes not leaving devices unattended in public places and ensuring secure passwords are in use. They should communicate these guidelines clearly to all staff.
HR should organise regular training sessions for employees on how to keep their devices safe outside the office.
This can include practical tips such as being aware of surroundings to avoid 'shoulder surfing' and the risks of logging into public Wi-Fi networks.
The procurement team should ensure all portable devices have the capability for remote wiping and tracking enabled.
This can be achieved by coordinating with the IT manager to check specifications before purchasing new devices.
Device owners should follow manufacturer guidelines for physical protection of equipment.
This includes using protective cases and screens, storing devices away from water or excessive heat, and contacting IT if unsure how to protect their device.
Management should require employees to log and get approval before taking devices outside the office.
A simple form can be used to track who takes what device where, ensuring there is an accountable trail if a device goes missing.
Keep it running
Regularly verify off-site devices have current encryption, remote wipe and tracking enabled to reduce theft or loss risk.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The organisation's policy on the use and security of off-site devices.
Look at
Whether the policy covers key areas like unattended devices and secure password use.
Good evidence
A comprehensive policy that aligns with ISO 27002:2022 guidelines.
- Check 2 of 5What an auditor asks for
Ask for
To see training records for employees on device security.
Look at
How often these trainings occur and if they cover recent security threats and protection strategies.
Good evidence
Regular, updated trainings attended by all relevant staff.
- Check 3 of 5What an auditor asks for
Ask for
Records of devices authorised to be taken off-site.
Look at
Whether these records include details like the device type, user, and purpose of removal.
Good evidence
A well-maintained log that reflects recent device movements.
- Check 4 of 5What an auditor asks for
Ask for
To see how the organisation tracks and manages the location and status of off-site devices.
Look at
Systems or software in use, their functionality, and how often they are audited.
Good evidence
A reliable system where devices can be tracked and wiped if necessary.
- Check 5 of 5What an auditor asks for
Ask for
About the protective measures applied to off-premise permanent installations.
Look at
The specific measures set for different environments, checking for physical security and access controls.
Good evidence
Tailored protection that mitigates the specific risks of each location.
Mappings
Closest match in ASD Information Security Manual: ISM-1400, Enforce data separation on personal devices, which this control covers in full and more.
ASD Information Security Manual: 5 mappings
This control is broader than ISM-1400.
ISM-1400 requires enforced separation of OFFICIAL: Sensitive or PROTECTED work data from personal data on privately-owned devices used to access that data. Annex A 7.9 requires protection of off-site assets, which includes devices used away from organisational premises and can include privately-owned devices when permitted. ISM-1400 is narrower and more prescriptive about logical separation, while Annex A 7.9 spans broader physical and procedural protections for off-site assets.
This control partially meets ISM-1554.
ISM-1554 addresses protecting mobile devices used off-site during overseas travel to high or extreme risk countries by mandating dedicated work-only travel devices/accounts and physical tamper-evidence checks. Annex A 7.9 requires that off-site assets are protected, which includes endpoint devices taken off premises. ISM-1554 is narrower because it focuses on a specific high-risk travel scenario and prescribes particular measures (dedicated travel pool and tamper seals) not required by Annex A 7.9.
This control partially overlaps ISM-0161.
Annex A 7.9 requires that off-site assets be protected against loss, theft, or damage. ISM-0161 mandates IT equipment and media be secured when not in use, a practical control that directly enhances the protection of laptops, removable media, and other items off-site. ISM-0161 supports Annex A 7.9 but does not cover broader off-site risks like in-transit controls.
This control partially overlaps ISM-0457.
Annex A 7.9 requires organisations to safeguard assets taken off-site. ISM-0457 mandates the use of ASD-endorsed cryptographic products for encrypting media with sensitive data, reducing confidentiality risks if off-site media is lost or stolen. ISM-0457 focuses on cryptographic assurance for specific data classes while Annex A 7.9 also includes physical protection and broader asset coverage.
This control partially overlaps ISM-0465.
Annex A 7.9 involves protecting assets outside organisational premises. ISM-0465 requires cryptographic protection of sensitive data when communicated over insecure networks, which is common off-site. ISM-0465 addresses secure communications while Annex A 7.9 covers preventing physical loss/theft and device protection.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.