ISO 27001 Annex A 5.11 is an ISO 27001 control that requires that people with organisation assets should return them when they leave.
In this guide you will learn how to implement ISO 27001 Annex A 5.11 Return of Assets and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.
Table of contents
Purpose & Definition
The purpose of ISO 27001 Annex A 5.11 is to ensure you protect the organisations assets as part of the process of changing or terminating employment, contract or agreement.
The ISO 27001 Standard defines ISO 27001 Annex A 5.11 as:
ISO 27001 Annex A 5.11 Return of assets requires personnel and external parties to return all organisational assets upon changing roles or ending employment. Documented handover rules prevent data leaks, track hardware, and protect confidential business property.
ISO 27001:2022 Annex A 5.11 Return of Assets
ISO 27001 Annex A 5.11 Video Tutorial
In free training video you will learn How to implement ISO 27001 Return Of Assets (Annex A 5.11) and Pass Your Audit.
Implementation Guide
You are going to have to
- Have an Asset Management Policy that sets out what you do for asset management
- Put in place an asset management process that describes exactly what you do through the asset management lifecycle
- Keep an asset register up to date that shows who is allocated what asset – which we covered in ISO 27001 Annex A 5.9 Inventory Of Information And Other Associated Assets Beginner’s Guide
- Put in place rules for the acceptable use of assets – which we covered in ISO 27001 Annex A 5.10 Acceptable Use Of Information And Other Associated Assets Beginner’s Guide
- Have legal contracts for employees and third parties that include clauses about assets, what they can do with them and that they must return them on termination
- Have a HR Starter, Leaver, Mover process that covers assets
You will need a process for people to return assets to you when they leave or your contract ends with them.
It is simple and straight forward but there a couple of steps to put in place first.
Consider that the employee that leaves.
Do we know what they have? Do they know they need to return it? How do they return it and in what time frame?
Asset Management Policy Template
The asset management policy sets out your approach to asset management and return of assets.
Data Asset Register
The Data Asset Register records the data as well as the data owner. It will be updated when a person leaves or moves role.
Data Asset Register Template
The data asset register is where you record your data assets and data owners. It is a data inventory.
Physical Asset Register
You will implement a Physical Asset Register that will include virtual machines. It records who the asset owner is and can be used to ensure that all assets are returned. You can learn more in our Beginner’s Guide to the Physical Asset Register.
Physical Asset Register Template
The physical asset register is where you record your physical assets and who owns them. It is a physical inventory.
How to implement ISO 27001 Annex A 5.11
Implementing ISO 27001 Annex A 5.11 is a critical security safeguard to ensure that organisational property, both physical and digital, is recovered when an individual’s relationship with the business ends. As a Lead Auditor, I have seen many organisations fail here because they rely on memory rather than a structured process.
1. Formalise the Return of Assets Policy
- Document clear requirements within your Information Security Policy that mandate the return of all hardware and software upon termination of employment or contract.
- Ensure the policy explicitly covers employees, contractors, and third-party consultants.
- Result: A legally enforceable mandate that sets clear expectations for all personnel from the outset of their engagement.
2. Integration with the Human Resources Exit Process
- Embed the asset return requirements into the standard HR exit interview and offboarding checklist.
- Coordinate timelines between HR, IT, and Department Heads to ensure assets are recovered before the final day of service.
- Result: A synchronised workflow that prevents personnel from leaving the premises while still in possession of critical assets.
3. Provision a Comprehensive Asset Register
- Maintain an accurate Asset Register that links specific serial numbers and logical assets to individual owners.
- Ensure the register includes “intangible” assets such as proprietary software licenses and encryption keys.
- Result: Full visibility of exactly what needs to be recovered from a specific individual during the offboarding phase.
4. Utilise Record of Equipment (ROE) Documentation
- Implement a Record of Equipment (ROE) log that requires a signature from the user upon receipt and return of physical items.
- Use these documents as the primary evidence for internal and external ISO 27001 audits.
- Result: An auditable paper trail that confirms the physical chain of custody for company hardware.
5. Revoke Logical Access via IAM Roles
- Immediately disable or delete accounts within your Identity and Access Management (IAM) system upon the exit date.
- Ensure that access to cloud repositories, SaaS applications, and internal databases is included in the revocation.
- Result: Immediate cessation of the user’s ability to access organisational data remotely or from personal devices.
6. De-provision Multi-Factor Authentication (MFA)
- Revoke MFA seeds and hardware tokens associated with the individual to prevent secondary bypass attempts.
- Ensure that company-owned mobile phones used for MFA are physically returned and factory reset.
- Result: Elimination of residual authentication pathways that could be exploited post-termination.
7. Secure the Handover of Critical Information
- Enforce a formal knowledge transfer process for administrative passwords, encryption keys, and master files.
- Verify that no “single point of failure” exists where only the departing individual has access to specific encrypted assets.
- Result: Continuous operational resilience and the prevention of data being locked out following a departure.
8. Implement Secure Data Sanitisation for Returned Assets
- Follow a formal decommissioning process that includes data wiping or physical destruction of storage media for returned hardware.
- Maintain certificates of destruction or sanitisation logs for all storage-bearing devices.
- Result: Prevention of data leakage when assets are repurposed for new employees or sent for recycling.
9. Manage the Return of Assets for Role Changes
- Apply the return of assets protocol when an employee moves to a new department with different security requirements.
- Recover assets and access rights that are no longer required for the new role to maintain the principle of least privilege.
- Result: Reduced internal risk by preventing “privilege creep” as staff move through the organisation.
10. Audit the Offboarding Process Regularly
- Conduct quarterly spot checks comparing HR leaver logs against the Asset Register and IAM revocation timestamps.
- Report any discrepancies to the management review meeting to ensure continuous process improvement.
- Result: Verification that the control is operating effectively and remains compliant with Annex A 5.11 requirements.
How to comply
To comply with ISO 27001 Annex A 5.11 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to
- Put in place contracts with employees and third parties that covers the use and return of assets
- Implement your HR Starter, Leaver, Mover process that includes assets
- Allocate assets to individuals and maintain a record
- On termination of contract ensure the secure transport and return of the asset
- Implement a process to securely store returned assets before reuse or reallocation
- Consider the remote wiping, as appropriate, of assets and devices before transport when returning
- Where employees and third parties use their own devices ensures processes are in place and followed for the deletion of company data assets
- Consider the documentation and knowledge transfer from employees and third parties
- Put in place appropriate controls during the notice period to prevent copying of information and intellectual property
What the auditor will check
The audit is going to check a number of areas. Lets go through them
1. There is a starter, leaver, mover process
The audit will check you have a starter, leaver, mover process documented and that you are following it. It will check that the return of assets is included in that process. It will then seek evidence that it has been followed at least once. They will randomly choose a sample of leavers and ask you to walk through what you did when you left. They are checking that you followed your written process and have evidence that the assets were returned.
2. There is an up to date asset register
The asset register will be checked to see that it meets the requirements of the standard and as a minimum that assets are allocated to owners. Where assets are returned, even if not reallocated, they will want to see that recorded in the asset register. They may then ask questions arounds the physical security of stored assets – such as are they locked away, who has access, what is the process for secure disposal / destruction.
3. Contracts are in place
They are going to look at your employee contracts and your third party contracts and see if the return of assets is mentioned and covered. There are other security clauses that are required, but where appropriate, they want to see that contracts cover the return of assets. This can include the deletion of data and information where personal or Bring Your Own Devices have been allowed and used. It would be sensible for them to sample any BYOD devices that belong to people that have left to ask you how you ensured data was deleted. Clearly they will not audit the actually device but the process you went through and the assurances that you got.
Top 3 mistakes people make
The top 3 Mistakes People Make For ISO 27001 Annex A 5.11 are
1. Your asset register is not up to date
Either not having an asset register, an asset register that does not record all devices or an asset register that is out of date is the number 1 mistake people make. Usually as it is admin step that can get lost in the course of running a business.
2. Assets were not destroyed securely
Not a direct response to the the return of assets but they do check secure destruction and that it followed process. It is a common for organisations to have a room full of old assets that they do not know what to do with so keep them for ever. It can be a nightmare in time as no one knows why we keep them, what is on them and if we need them which brings up legal, regulatory and contractual issues.
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
ISO 27001 Annex A 5.11 FAQ
For ISO 27001 Annex A 5.11 Return of Assets you will need the ISO 27001 Asset Management Policy
ISO 27001 Annex A 5.11 Return of Assets is important because those assets likely contain confidential data, data covered by laws such as the GDPR / Data Protection Laws and intellectual property. The job of information security is the protection of confidentiality, integrity and availability of data that can all be compromised when a contract with an employee or third party ends and yet they still have access and copies of information. There is also the financial cost of the asset itself which sits in the accounts.
It is your responsibility to ensure that when the contract ends with the employee or third party that all company data assets have been securely destroyed and deleted. You will also ensure that all access has been removed.
This can be a good practice to adopt. It removes the risk of the asset going missing in transit. If appropriate to you and your situation we would encourage this best practice.
Yes. Whilst the ISO 27001 Annex A clauses are for consideration to be included in your Statement of Applicability there is no reason we can think of that would allow you to exclude ISO 27001 Annex A 5.11. Asset Management and the return of assets are a fundamental part of any information security defence and control. They are a fundamental part of any information security management system. They are explicitly required for ISO 27001.
Yes. You can write the policies for ISO 27001 Annex A 5.11 yourself. You will need a copy of the standard and approximately 3 days of time to do it. It would be advantageous to have a background in information security management systems. There are a number of documents you will require as well as the policy for role based access control. Alternatively you can download them in the High Table ISO 27001 Toolkit.
ISO 27001 templates for ISO 27001 Annex A 5.11 are located in the High Table ISO 27001 Toolkit.
ISO 27001 Annex A 5.11 is not particularly hard. It can take a lot of time if you are doing it yourself but it is not technically very hard. You are going to implement and asset management policy, put in place a stater leaver mover process, have an up to date asset register, have contracts in place and ensure assets are returned at the end of contracts.Fairly straightforward. We would recommend templates to fast track your implementation.
ISO 27001 Annex A 5.11 will take approximately 5 days to complete if you are starting from nothing and doing it yourself. With an ISO 27001 Toolkit it should take you less than 1 day.
The cost of ISO 27001 Annex A 5.11 will depend how you go about it. If you do it yourself it will be free but will take you about 5 days so the cost is lost opportunity cost as you tie up resource doing something that can easily be downloaded. If you download an ISO 27001 Policy Template toolkit then you are looking at a couple of hundred pounds / dollars.
Yes, a documented policy or procedure for the return of assets is essential to satisfy the requirements of Annex A 5.11 and provide legal standing for equipment recovery.
It defines clear timelines for the return of equipment.
It outlines the specific roles and responsibilities of HR, IT, and management.
It establishes the legal right to recover costs for unreturned items where applicable.
It provides a repeatable framework for auditors to verify compliance.
The scope of Annex A 5.11 extends beyond physical hardware to include all types of information and organisational property.
Physical hardware: Laptops, mobile phones, tablets, and monitors.
Access credentials: ID badges, physical keys, and MFA tokens.
Information assets: Intellectual property, customer data, and printed documentation.
Digital assets: Backups, software licenses, and cloud-stored corporate files.
The responsibility for managing the return of assets is typically shared across HR, IT, and the departing individual’s line manager.
HR: Initiates the offboarding workflow and communicates final requirements to the leaver.
IT: Verifies the return and functional state of technical hardware and digital data.
Line Manager: Ensures physical hand-overs occur and access cards are recovered on the final day.
Individual: Contractually obligated to return all property in their possession.
Yes, digital information assets are a core focus of Annex A 5.11, requiring users to return or delete corporate data stored on personal or external devices.
Includes the removal of corporate email accounts from personal smartphones.
Requires the handover of any administrative passwords or encryption keys.
Mandates the return of physical storage media like USB drives or external hard disks.
Covers intellectual property created during the term of employment.
Failure to return assets should be treated as a security incident and managed through defined legal and contractual escalations.
Immediate remote wiping of mobile devices and laptops where technically possible.
Reporting unreturned items to insurance providers for replacement recovery.
Legal communication regarding the retention of intellectual property.
Withholding final settlement amounts where permitted by local employment laws.
ISO 27001 Controls and Attribute Values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Confidentiality | Protect | Asset management | Protection |
| Integrity | ||||
| Availability |
Stuart Barker
Stuart Barker is qualified ISO 27001 Lead Auditor and a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigour with extensive operational experience, including a decade leading Data Governance for General Electric (GE).
Now he is founder and Lead ISO 27001 Consultant at High Table, the worlds number 1 dedicated ISO 27001 Consultancy.
