In this ultimate how to audit guide to ISO 27001 Annex A 7.9 Security of Assets Off-Premises, you will learn directly from an ISO 27001 Lead Auditor:

• 10 Key Audit Steps
• Verification Criteria
• Required Evidence
• The Pass / Fail Test

I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.

Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.

ISO 27001 Annex A 7.9 Security of Assets Off-Premises Audit Checklist

Auditing ISO 27001 Annex A 7.9 Security of Assets Off-Premises is the technical verification of security controls for devices used outside the organisation’s perimeter. The Primary Implementation Requirement is full-disk encryption and remote wipe capability, providing the Business Benefit of protecting data against loss or theft.

This technical verification tool is designed for lead auditors to establish the continuous protection of organisational assets when used outside the primary security perimeter. Use this checklist to validate compliance with ISO 27001 Annex A 7.9.

1. Off-Premises Asset Usage Policy Verified

Verification Criteria: A documented policy exists that explicitly defines the authorisation requirements and security standards for assets taken off-premises.

Required Evidence: Approved “Off-Premises Asset Policy” or “Mobile Working Policy” with evidence of senior management sign-off.

Pass/Fail Test: If the organisation cannot produce a formal policy governing the removal and usage of assets outside the office, mark as Non-Compliant.

2. Asset Authorisation and Removal Logs Confirmed

Verification Criteria: Every instance of an asset leaving the premises is authorised by management and recorded in a log or tracking system.

Required Evidence: Asset movement logs or digital “Removal of Assets” request approvals in the ITSM or HR system.

Pass/Fail Test: If a physical inspection reveals assets missing from the office that have no corresponding authorisation record or removal log, mark as Non-Compliant.

3. Full Disk Encryption (FDE) Enforcement Validated

Verification Criteria: All portable assets (laptops, tablets, external drives) are protected by technical full-disk encryption to prevent data exposure upon loss or theft.

Required Evidence: MDM (Mobile Device Management) or Endpoint Protection reports showing “Encrypted” status for all off-premises endpoints.

Pass/Fail Test: If a sampled laptop assigned for remote use is found to have BitLocker, FileVault, or equivalent encryption disabled, mark as Non-Compliant.