How to Audit ISO 27001 Annex A 7.13: Security of Assets Off-premises

In this ultimate how to audit guide to ISO 27001 Annex A 7.13 Security of Assets Off-premises, you will learn directly from an ISO 27001 Lead Auditor:

• 10 Key Audit Steps
• Verification Criteria
• Required Evidence
• The Pass / Fail Test

I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.

Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.

ISO 27001 Annex A 7.13 Security of Assets Off-premises Audit Checklist

Auditing ISO 27001 Annex A 7.13 Security of Assets Off-premises is the critical evaluation of technical controls protecting devices outside secure perimeters. The Primary Implementation Requirement involves enforcing full-disk encryption and remote wiping, providing the Business Benefit of mitigating data leakage risks from stolen or lost physical assets.

This technical verification tool is designed for lead auditors to establish the continuous protection of organisational assets when used outside the primary security perimeter. Use this checklist to validate compliance with ISO 27001 Annex A 7.13.

1. Off-premises Asset Authorisation Records Verified

Verification Criteria: Every instance of an information processing asset being removed from the organisation’s premises is supported by a documented authorisation from an appropriate level of management.

Required Evidence: Approved Asset Removal Requests or digital authorisation logs within the ITSM or HR system.

Pass/Fail Test: If a physical asset is missing from the office but has no corresponding recorded management approval for its removal, mark as Non-compliant.

2. Off-premises Asset Security Policy Formalised

Verification Criteria: A documented policy exists that explicitly defines the security standards, handling requirements, and personal responsibilities for assets used in remote or public environments.

Required Evidence: Approved “Mobile Working Policy” or “Off-premises Asset Policy” with evidence of recent management review.

Pass/Fail Test: If the organisation lacks a formalised set of rules for protecting assets outside the office (e.g., in transit or home offices), mark as Non-compliant.

3. Full Disk Encryption (FDE) Enforcement Validated

Verification Criteria: Technical controls are active on all portable devices to ensure that data remains inaccessible in the event of theft or loss during off-premises use.

Required Evidence: MDM (Mobile Device Management) or Endpoint Management reports showing “Encrypted” status for 100% of sampled remote endpoints.

Pass/Fail Test: If a sampled off-premises laptop is found to have BitLocker, FileVault, or equivalent encryption disabled or not managed centrally, mark as Non-compliant.