ISO27001 Annex A 5.11 Return Of Assets Beginner’s Guide

ISO 27001 Return of Assets – Annex A 5.11

Introduction

I am going to show you what ISO 27001:2022 Annex A 5.11 Return of Assets is, what’s new, give you ISO 27001 templates, show you examples, do a walkthrough and show you how to implement it.

I am Stuart Barker the ISO 27001 Ninja and using over two decades of experience on hundreds of ISO 27001 audits and ISO 27001 certifications I show you exactly what changed in the ISO 27001:2022 update and exactly what you need to do for ISO 27001 certification.

What is ISO 27001 Return of Assets?

ISO 27001:2022 Annex A 5.11 Return of Assets is an ISO 27002:2022 control that requires that people with organisation assets should return them when they leave.

ISO 27001 Annex A 5.11 Purpose

Annex A 5.2 is a preventive control that ensures you protect the organisations assets as part of the process of changing or terminating employment, contract or agreement.

ISO 27001 Annex A 5.11 Definition

The ISO 27001:2022 standard defines ISO 27001:2022 Annex A 5.11 as:

Personnel and other interested parties as appropriate should return all the organisation’s assets in their possession upon change or termination of their employment, contract or agreement.

ISO 27001:2022 Annex A 5.11 Return of Assets

ISO 27001 Return of Assets Implementation Guide

You are going to have to

You will need a process for people to return assets to you when they leave or your contract ends with them.

It is simple and straight forward but there a couple of steps to put in place first.

Consider that the employee that leaves.

Do we know what they have? Do they know they need to return it? How do they return it and in what time frame?

FREE 30 minute ISO 27001 strategy session.

Claim your 100% FREE no-obligation 30 minute strategy session call (£1000 value). This is strictly for small businesses who are hungry to get ISO 27001 certified up to 10x faster and 30x cheaper.

ISO27001 Certification Stragey Call

ISO 27001 Return of Assets Templates

If you want to write these yourself I totally commend you. And pity you in equal measure. You could save months of effort with these ISO 27001 templates that take 25 years of experience and distill it in a pack of prewritten best practice awesomeness.

ISO 27001 Annex A 5.11 Return of Assets ISO 27001 Templates Toolkit

How to comply with ISO 27001:2022 Annex A 5.11

To comply with ISO 27001:2022 Annex A 5.11 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to

  • Put in place contracts with employees and third parties that covers the use and return of assets
  • Implement your HR Starter, Leaver, Mover process that includes assets
  • Allocate assets to individuals and maintain a record
  • On termination of contract ensure the secure transport and return of the asset
  • Implement a process to securely store returned assets before reuse or reallocation
  • Consider the remote wiping, as appropriate, of assets and devices before transport when returning
  • Where employees and third parties use their own devices ensures processes are in place and followed for the deletion of company data assets
  • Consider the documentation and knowledge transfer from employees and third parties
  • Put in place appropriate controls during the notice period to prevent copying of information and intellectual property

How to pass an audit of ISO 27001:2022 Annex A 5.11

To pass an audit of ISO 27001:2022 Annex A 5.11 you are going to make sure that you have followed the steps above in how to comply.

You are going to do that by first conducting an internal audit, following the How to Conduct an ISO 27001 Internal Audit Guide.

What will an audit check?

The audit is going to check a number of areas. Lets go through them

1. There is a starter, leaver, mover process

The audit will check you have a starter, leaver, mover process documented and that you are following it. It will check that the return of assets is included in that process. It will then seek evidence that it has been followed at least once. They will randomly choose a sample of leavers and ask you to walk through what you did when you left. They are checking that you followed your written process and have evidence that the assets were returned.

2. There is an up to date asset register

The asset register will be checked to see that it meets the requirements of the standard and as a minimum that assets are allocated to owners. Where assets are returned, even if not reallocated, they will want to see that recorded in the asset register. They may then ask questions arounds the physical security of stored assets – such as are they locked away, who has access, what is the process for secure disposal / destruction.

3. Contracts are in place

They are going to look at your employee contracts and your third party contracts and see if the return of assets is mentioned and covered. There are other security clauses that are required, but where appropriate, they want to see that contracts cover the return of assets. This can include the deletion of data and information where personal or Bring Your Own Devices have been allowed and used. It would be sensible for them to sample any BYOD devices that belong to people that have left to ask you how you ensured data was deleted. Clearly they will not audit the actually device but the process you went through and the assurances that you got.

Top 3 Mistakes People Make for ISO 27001 Return of Assets

The top 3 Mistakes People Make For ISO 27001:2022 Annex A 5.11 are

1. Your asset register is not up to date

Either not having an asset register, an asset register that does not record all devices or an asset register that is out of date is the number 1 mistake people make. Usually as it is admin step that can get lost in the course of running a business.

2. Assets were not destroyed securely

Not a direct response to the the return of assets but they do check secure destruction and that it followed process. It is a common for organisations to have a room full of old assets that they do not know what to do with so keep them for ever. It can be a nightmare in time as no one knows why we keep them, what is on them and if we need them which brings up legal, regulatory and contractual issues.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

Why is ISO 27001:2022 Annex A 5.11 Important?

ISO 27001:2022 Annex A 5.11 Return of Assets is important because those assets likely contain confidential data, data covered by laws such as the GDPR / Data Protection Laws and intellectual property. The job of information security is the protection of confidentiality, integrity and availability of data that can all be compromised when a contract with an employee or third party ends and yet they still have access and copies of information. There is also the financial cost of the asset itself which sits in the accounts.

ISO 27001 Return of Assets FAQ

What policies do I need for ISO 27001:2022 Annex A 5.11 Return of Assets?

For ISO 27001:2022 Annex A 5.11 Return of Assets you will need the ISO 27001 Asset Management Policy: https://hightable.io/product/asset-management-policy-template/

What if someone has used their own device?

It is your responsibility to ensure that when the contract ends with the employee or third party that all company data assets have been securely destroyed and deleted. You will also ensure that all access has been removed.

Do I delete data before the asset is returned?

This can be a good practice to adopt. It removes the risk of the asset going missing in transit. If appropriate to you and your situation we would encourage this best practice.

Are there free templates for ISO 27001:2022 Annex A 5.11?

There are templates for ISO 27001:2022 Annex A 5.11 located here: https://hightable.io/iso-27001-toolkit/

ISO 27001:2022 Annex A 5.11 sample PDF?

ISO 27001:2022 Annex A 5.11 Sample PDF: https://hightable.io/iso-27001-toolkit/

Do I have to satisfy ISO 27001:2022 Annex A 5.11 for ISO 27001 Certification?

Yes. Whilst the ISO 27001:2022 Annex A clauses are for consideration to be included in your Statement of Applicability there is no reason we can think of that would allow you to exclude ISO 27001:2022 Annex A 5.11. Asset Management and the return of assets are a fundamental part of any information security defence and control. They are a fundamental part of any information security management system. They are explicitly required for ISO 27001.

Can I write polices for ISO 27001:2022 Annex A 5.11 myself?

Yes. You can write the policies for ISO 27001:2022 Annex A 5.11 yourself. You will need a copy of the standard and approximately 3 days of time to do it. It would be advantageous to have a background in information security management systems. There are a number of documents you will require as well as the policy for role based access control. Alternatively you can download them here: https://hightable.io/iso-27001-toolkit/

Where can I get templates for ISO 27001:2022 Annex A 5.11?

ISO 27001 templates for ISO 27001:2022 Annex A 5.11 are located here: https://hightable.io/iso-27001-toolkit/

How hard is ISO 27001:2022 Annex A 5.11?

ISO 27001:2022 Annex A 5.11 is not particularly hard. It can take a lot of time if you are doing it yourself but it is not technically very hard. You are going to implement and asset management policy, put in place a stater leaver mover process, have an up to date asset register, have contracts in place and ensure assets are returned at the end of contracts.Fairly straightforward. We would recommend templates to fast track your implementation.

How long will ISO 27001:2022 Annex A 5.11 take me?

ISO 27001:2022 Annex A 5.11 will take approximately 5 days to complete if you are starting from nothing and doing it yourself. With an ISO 27001 Template Toolkit it should take you less than 1 day.

How much will ISO 27001:2022 Annex A 5.11 cost me?

The cost of ISO 27001:2022 Annex A 5.11 will depend how you go about it. If you do it yourself it will be free but will take you about 5 days so the cost is lost opportunity cost as you tie up resource doing something that can easily be downloaded. If you download an ISO 27001 Policy Template toolkit then you are looking at a couple of hundred pounds / dollars.

Get the Help of the ISO 27001 Ninja

Book your FREE 30 Minute ISO 27001 Strategy Call and let me show you how you can do it 30x cheaper and 10x faster that you ever thought possible.

Free ISO27001 Strategy Call

Matrix of ISO 27001 Controls and ISO 27001 Attribute Values

Control typeInformation
security properties
Cybersecurity
concepts
Operational
capabilities
Security domains
#Preventive
#Confidentiality
#Integrity
#Availability
#Protect#Asset_management#Protection

Reference

ISO/IEC 27001 Information Security Management

ISO 27001 Templates Toolkit Business Edition Black
ISO27001 Policy Templates Pack Green

FREE 30 minute ISO 27001 strategy session.

Claim your 100% FREE no-obligation 30 minute strategy session call (£1000 value). This is strictly for small businesses who are hungry to get ISO 27001 certified up to 10x faster and 30x cheaper.

ISO27001 Certification Stragey Call

Shopping Basket