Security of Assets Off-Premises - ISO 27001 Annex A Control
ISO 27001 Annex A 7.9
Equipment outside the building still needs the protection it would have inside.
ISO 27001 Annex A 7.9 - Security of Assets Off-Premises
Modern operations rarely keep all equipment within the office walls. Laptops travel home, to client sites, to coffee shops and overseas. Mobile phones move with their owners. Equipment loaned for events, secondments or remote working can be off-site for extended periods. The control asks the organisation to extend protection to these assets rather than treating them as outside the security perimeter.
The protection comes in layers. Technical controls cover the device itself - encryption, multi-factor authentication, mobile device management, the ability to wipe remotely. Procedural controls cover handling - what staff can leave in cars, hotel rooms, and shared workspaces; what to do if a device is lost; how to report incidents quickly. Awareness training reinforces the practices.
The control links closely to remote working under A.6.7 but covers a wider scope. Off-premises assets includes equipment in transit, equipment loaned to third parties, equipment temporarily housed at client sites, and any other situation where the asset is outside the organisation's direct physical control. Each scenario needs to be considered in the policy.
The most common off-premises issue is the lost laptop in a public space - a cafe, a train, a hotel lobby. The technical controls usually hold up because the device is encrypted and locked, but the practical effect on the organisation comes down to how quickly the loss is reported and the remote wipe is triggered. Slow reporting turns a recoverable situation into a much harder one.
The audit test is whether the policy fits the actual working pattern. If staff routinely take equipment to coffee shops and the policy does not address it, that is a gap. If the policy says equipment must never leave the building but staff travel constantly, the policy has been overtaken by reality. The control needs to reflect how the organisation actually works.
Practical Compliance Guidance
Off-premises asset protection is described in the IMS1 manual at section 8.3 on IT equipment and section 8.5 alongside the Remote Working Policy. The equipment register tracks issued assets.
| alphaZ document | How to use it |
|---|---|
| ISO 27001 Toolkit | The full alphaZ ISO 27001 toolkit covering manual, policies, procedures, registers and audit checklists. |
Note - all the above files can be downloaded with an alphaZ subscription.
