ISO 27001:2022 Annex A 5.11 Return of Assets Explained

In this guide you will learn how to implement ISO 27001 Annex A 5.11 Return of Assets and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.

Purpose & Definition

The purpose of ISO 27001 Annex A 5.11 is to ensure you protect the organisations assets as part of the process of changing or terminating employment, contract or agreement.

ISO 27001 Annex A 5.11 Training Video

In this free training video you will learn How to implement ISO 27001 Return Of Assets (Annex A 5.11) and Pass Your Audit.

Implementation Guide

You are going to have to

• Have an Asset Management Policy that sets out what you do for asset management
• Put in place an asset management process that describes exactly what you do through the asset management lifecycle
• Keep an asset register up to date that shows who is allocated what asset – which we covered in ISO 27001 Annex A 5.9 Inventory Of Information And Other Associated Assets Beginner’s Guide
• Put in place rules for the acceptable use of assets – which we covered in ISO 27001 Annex A 5.10 Acceptable Use Of Information And Other Associated Assets Beginner’s Guide
• Have legal contracts for employees and third parties that include clauses about assets, what they can do with them and that they must return them on termination
• Have a HR Starter, Leaver, Mover process that covers assets

You will need a process for people to return assets to you when they leave or your contract ends with them.

It is simple and straight forward but there a couple of steps to put in place first.

Consider that the employee that leaves.

Do we know what they have? Do they know they need to return it? How do they return it and in what time frame?

Asset Management Policy Template

Data Asset Register

The Data Asset Register records the data as well as the data owner. It will be updated when a person leaves or moves role.

Data Asset Register Template

Physical Asset Register

You will implement a Physical Asset Register that will include virtual machines. It records who the asset owner is and can be used to ensure that all assets are returned. You can learn more in our Beginner’s Guide to the Physical Asset Register.

Physical Asset Register Template

How to implement ISO 27001 Annex A 5.11

Implementing ISO 27001 Annex A 5.11 is a critical security safeguard to ensure that organisational property, both physical and digital, is recovered when an individual’s relationship with the business ends. As a Lead Auditor, I have seen many organisations fail here because they rely on memory rather than a structured process. By following these 10 steps, you will establish a watertight offboarding procedure that protects your intellectual property and reduces your attack surface. This process ensures that assets are returned, access is revoked, and the risk of post-employment data breaches is effectively mitigated.

1. Formalise the Return of Assets Policy

• Document clear requirements within your Information Security Policy that mandate the return of all hardware and software upon termination of employment or contract.
• Ensure the policy explicitly covers employees, contractors, and third-party consultants.
• Result: A legally enforceable mandate that sets clear expectations for all personnel from the outset of their engagement.

2. Integration with the Human Resources Exit Process

• Embed the asset return requirements into the standard HR exit interview and offboarding checklist.
• Coordinate timelines between HR, IT, and Department Heads to ensure assets are recovered before the final day of service.
• Result: A synchronised workflow that prevents personnel from leaving the premises while still in possession of critical assets.

3. Provision a Comprehensive Asset Register

• Maintain an accurate Asset Register that links specific serial numbers and logical assets to individual owners.
• Ensure the register includes “intangible” assets such as proprietary software licenses and encryption keys.
• Result: Full visibility of exactly what needs to be recovered from a specific individual during the offboarding phase.

4. Utilise Record of Equipment (ROE) Documentation

• Implement a Record of Equipment (ROE) log that requires a signature from the user upon receipt and return of physical items.
• Use these documents as the primary evidence for internal and external ISO 27001 audits.
• Result: An auditable paper trail that confirms the physical chain of custody for company hardware.

5. Revoke Logical Access via IAM Roles

• Immediately disable or delete accounts within your Identity and Access Management (IAM) system upon the exit date.
• Ensure that access to cloud repositories, SaaS applications, and internal databases is included in the revocation.
• Result: Immediate cessation of the user’s ability to access organisational data remotely or from personal devices.

6. De-provision Multi-Factor Authentication (MFA)

• Revoke MFA seeds and hardware tokens associated with the individual to prevent secondary bypass attempts.
• Ensure that company-owned mobile phones used for MFA are physically returned and factory reset.
• Result: Elimination of residual authentication pathways that could be exploited post-termination.

7. Secure the Handover of Critical Information

• Enforce a formal knowledge transfer process for administrative passwords, encryption keys, and master files.
• Verify that no “single point of failure” exists where only the departing individual has access to specific encrypted assets.
• Result: Continuous operational resilience and the prevention of data being locked out following a departure.

8. Implement Secure Data Sanitisation for Returned Assets

• Follow a formal decommissioning process that includes data wiping or physical destruction of storage media for returned hardware.
• Maintain certificates of destruction or sanitisation logs for all storage-bearing devices.
• Result: Prevention of data leakage when assets are repurposed for new employees or sent for recycling.

9. Manage the Return of Assets for Role Changes

• Apply the return of assets protocol when an employee moves to a new department with different security requirements.
• Recover assets and access rights that are no longer required for the new role to maintain the principle of least privilege.
• Result: Reduced internal risk by preventing “privilege creep” as staff move through the organisation.

10. Audit the Offboarding Process Regularly

• Conduct quarterly spot checks comparing HR leaver logs against the Asset Register and IAM revocation timestamps.
• Report any discrepancies to the management review meeting to ensure continuous process improvement.
• Result: Verification that the control is operating effectively and remains compliant with Annex A 5.11 requirements.

How to comply

To comply with ISO 27001 Annex A 5.11 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to

• Put in place contracts with employees and third parties that covers the use and return of assets
• Implement your HR Starter, Leaver, Mover process that includes assets
• Allocate assets to individuals and maintain a record
• On termination of contract ensure the secure transport and return of the asset
• Implement a process to securely store returned assets before reuse or reallocation
• Consider the remote wiping, as appropriate, of assets and devices before transport when returning
• Where employees and third parties use their own devices ensures processes are in place and followed for the deletion of company data assets
• Consider the documentation and knowledge transfer from employees and third parties
• Put in place appropriate controls during the notice period to prevent copying of information and intellectual property

What the auditor will check

The audit is going to check a number of areas. Lets go through them

1. There is a starter, leaver, mover process

The audit will check you have a starter, leaver, mover process documented and that you are following it. It will check that the return of assets is included in that process. It will then seek evidence that it has been followed at least once. They will randomly choose a sample of leavers and ask you to walk through what you did when you left. They are checking that you followed your written process and have evidence that the assets were returned.

2. There is an up to date asset register

The asset register will be checked to see that it meets the requirements of the standard and as a minimum that assets are allocated to owners. Where assets are returned, even if not reallocated, they will want to see that recorded in the asset register. They may then ask questions arounds the physical security of stored assets – such as are they locked away, who has access, what is the process for secure disposal / destruction.

3. Contracts are in place

They are going to look at your employee contracts and your third party contracts and see if the return of assets is mentioned and covered. There are other security clauses that are required, but where appropriate, they want to see that contracts cover the return of assets. This can include the deletion of data and information where personal or Bring Your Own Devices have been allowed and used. It would be sensible for them to sample any BYOD devices that belong to people that have left to ask you how you ensured data was deleted. Clearly they will not audit the actually device but the process you went through and the assurances that you got.

Top 3 Mistakes People Make and How to Avoid Them

The top 3 Mistakes People Make For ISO 27001 Annex A 5.11 are

1. Your asset register is not up to date

Either not having an asset register, an asset register that does not record all devices or an asset register that is out of date is the number 1 mistake people make. Usually as it is admin step that can get lost in the course of running a business.

2. Assets were not destroyed securely

Not a direct response to the the return of assets but they do check secure destruction and that it followed process. It is a common for organisations to have a room full of old assets that they do not know what to do with so keep them for ever. It can be a nightmare in time as no one knows why we keep them, what is on them and if we need them which brings up legal, regulatory and contractual issues.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

ISO 27001 Annex A 5.11 FAQ

ISO 27001 Controls and Attribute Values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Confidentiality	Protect	Asset management	Protection
	Integrity
	Availability