Control A.7.9Security of assets off-premises
Off-site assets must be protected.
Any asset outside the organisation’s premises — laptops in homes and hotels, phones, removable media, equipment at a supplier’s site, and equipment in transit — carries the organisation’s information without the organisation’s physical controls around it.
The control asks for the protection to be decided rather than assumed: what may leave, what protection travels with it (encryption under A.8.24 is usually the answer that does the most), how it is tracked, and what happens when it does not come back.
Tracking is the part that depends on A.5.9’s inventory being real. An organisation that cannot say what is off-site cannot know what was lost.
Travel to higher-risk jurisdictions is where organisations most often need a specific policy and least often have one — device choices, what data travels, what happens if equipment is inspected or retained, and how the person is supported if it is.
How to put this in place
Laptops and phones are lost and stolen away from the building, so the project must control them wherever they go. Unencrypted or unmanaged devices turn a lost bag into a reportable breach.
- Decide which devices may hold company information and where they may be used.
- Encrypt all portable devices and enrol them in central management that can lock or wipe them.
- Write short rules for travel and home use.
- Require loss or theft to be reported at once, and rehearse the response.
- Report device encryption and management coverage regularly.
Evidence an auditor usually looks for: device management reports showing encryption and enrolment, loss reports, and remote wipes carried out.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.