ISO 27001:2022 Annex A 7.9 Security of Assets Off-Premises: The Lead Auditor’s Guide.

ISO 27001 Annex A 7.9 Security of Assets Off-Premises is a security control that mandates the protection of hardware and information outside the organization’s physical perimeter. It requires risk-based safeguards, such as full-disk encryption and physical supervision, to prevent theft, loss, or unauthorized access, ensuring business continuity during remote work operations.

In this guide, I will show you exactly how to implement ISO 27001 Annex A 7.9 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy.

I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience conducting hundreds of audits. I will cut through the jargon to show you exactly what changed in the 2022 update and provide you with plain-English advice to get you certified.

Key Takeaways: ISO 27001 Annex A 7.9 Security of Assets Off-Premises

ISO 27001 Annex A 7.9 requires organizations to protect off-site assets (laptops, phones, portable drives) from loss, theft, or compromise. In a modern remote-work economy, you no longer control the physical environment where your equipment is used. The goal of this control is to bridge that gap by equipping employees with the right tools, policies, and training to maintain security while working from homes, cafes, or during travel.

Core requirements for compliance include:

• Risk-Based Protection: You must identify the unique threats of off-site work (e.g., theft from cars, public Wi-Fi hacking, or “shoulder surfing”) and implement proportionate controls.
• Mandatory Encryption: All off-premises devices containing sensitive data must be encrypted. If a laptop is stolen from a car, the data remains unreadable.
• Physical Security Training: Employees must be explicitly trained on how to handle equipment in public. This includes rules like “never leave a laptop unattended in a coffee shop” and “lock devices in the hotel safe.”
• Remote Management (MDM): You should have the technical ability to remotely lock or wipe a device if it is reported stolen, ensuring that company data doesn’t remain on an at-risk asset.
• Authorization & Inventory: While modern work is flexible, you must still track which assets are off-premises and ensure that only authorized equipment is used to access company systems.

Audit Focus: Auditors will look for “The Human Element”:

1. Policy Acknowledgement: “Show me that your remote workers have read and signed your ‘Mobile Device & Off-Site Work’ policy.”
2. Screen Sharing Check: During a remote audit, an auditor may ask a worker: “If you were working in a cafe right now, what physical tools (like a privacy screen) would you use to protect your work?”
3. The Wipe Test: “Show me the record of the last time a device was lost. Did you successfully wipe the data remotely?”

Public Space Security Checklist (Audit Prep):

Usage Scenario	Primary Security Risk	Required ISO 27001 Action	ISO 27001:2022 Control
In a Car	Theft (Smash & Grab).	Lock in the trunk/boot before arriving at your destination.	7.9 (Off-Premises Assets)
Coffee Shop	Theft (Snatch & Run).	Never leave the device unattended, even for a minute.	7.9 (Off-Premises Assets)
Train / Plane	Shoulder Surfing (Visual Eavesdropping).	Use a Privacy Screen Filter and position the screen away from others.	7.10 (Storage Media)
Hotel Room	Unauthorised Access / Theft.	Lock the device in the room safe or keep it on your person.	7.9 (Off-Premises Assets)

What is ISO 27001 Annex A 7.9?

The focus for this ISO 27001 Control is your assets. As one of the ISO 27001 controls this is about the protection of those assets when not in an environment you control.

ISO 27001 Annex A 7.9 Security of assets off-premises is an ISO 27001 control that looks to protect equipment by siting it securely and protecting it.

ISO 27001 Annex A 7.9 Purpose

The purpose of ISO 27001 Security Of Assets Off-Premises is to prevent loss, damage, theft or compromise of off-site devices and interruption to the organisations operations..

ISO 27001 Annex A 7.9 Definition

The ISO 27001 standard defines ISO 27001 Annex A 7.9 as:

Off-site assets should be protected.

ISO 27001:2022 Annex A 7.9 Security of assets off-premises

ISO 27001 Annex A 7.9 Free Training Video

In the video ISO 27001 Security of Assets Off Premises Explained – ISO27001:2022 Annex A 7.9 I show you how to implement it and how to pass the audit.

ISO 27001 Annex A 7.9 Explainer Video

In this beginner’s guide to ISO 27001 Annex A 7.9 Security Of Assets Off-Premises, ISO 27001 Lead Auditor Stuart Barker and his team talk you through what it is, how to implement in and how to pass the audit. Free ISO 27001 training.

ISO 27001 Annex A 7.9 Podcast

In this episode: Lead Auditor Stuart Barker and team do a deep dive into the ISO 27001 Annex A 7.9 Security Of Assets Off-Premises. The podcast explores what it is, why it is important and the path to compliance.

ISO 27001 Annex A 7.9 Implementation Guidance

General Guidance

Well in this modern world people take their equipment of site. This used to be a massive thing a few years ago when everyone was chained to an office and all the equipment stayed at the office. Taking things off site was such a palaver, with forms and authorisation and massive forklift trucks to move those ‘laptops’. Things have moved on but the control remains now with a more general focus on the protection of assets off site. Rather than the process of authorising it.

Education and Training

Like much of the standard we are looking at common sense really when it comes to this control. There is a combination of telling people what is expected, training them, educating them and also where possible putting some technical controls in place if they help reduce risk.

Off Site Protection

We always want to protect what is important to us so in this situation we are looking at what are the threats that can be posed by having assets in an environment that we do not control and therefore what are things we can do to address those threats.

Public Areas

Simple things like not having assets left unattended in public areas. Seems to make sense but we have all seen people leave laptops open in bars, restaurants and on trains whilst they go and ‘use the facilities’.

Shoulder Surfing

There is a lot of shoulder surfing that goes on as well. People reading over your shoulder or between the gaps in train and aeroplane seats. We all like to be nosey, am I right? We can do things like be conscious of it and position ourselves so as not to facilitate it and we can consider the use of privacy screens and screen protectors. What ever works for you.

How to implement ISO 27001 Annex A 7.9

Related Controls

There are a couple of other controls worth reading up here as well being ISO 27001 Annex A 6.7 Remote Working and ISO 27001 Annex A 8.1 User End Point Devices.

Public Space Security Checklist

Scenario	Risk	Required Action
In a Car	Theft (Smash & Grab)	Lock in the Boot/Trunk before parking.
Coffee Shop	Theft (Snatch)	Never leave device unattended (even for 1 min).
Train/Plane	Shoulder Surfing	Use a Privacy Screen Filter.
Hotel Room	Cleaning Staff Access	Lock in the Room Safe when out.

ISO 27001 Templates

For Annex A 7.9 Security Of Assets Off-Premises you need a topic specific Physical and Environmental Security Policy Template.

Having ISO 27001 templates can help fast track your ISO 27001 implementation. The ISO 27001 Toolkit is the ultimate resource for your ISO 27001 certification.

How to comply

To comply with ISO 27001 Annex A 7.9 Security Of Assets Off-Premises you are going to

• Train, educate, tell and communicate to people what is expected of them
• Assess you assets and perform a risk assessment
• Implement controls proportionate to the risk posed
• Test the controls that you have to make sure they are working

Top 3 ISO 27001 Annex A 7.9 mistakes and how to avoid them

The top 3 mistakes people make for ISO 27001 Annex A 7.9 Security Of Assets Off-Premises are

• You haven’t told people what is expected: It is really hard to control assets when you don’t control the environment that they are in. You cannot account for every situation and variable but you can equip people with the knowledge to make the right choices and the tools to reduce the risks. If you don’t communicate and educate and inform then this control will fail.
• One or more members of your team haven’t done what they should have done: Prior to the audit check that all members of the team have done what they should have. Do they know where the policies are? Have they acknowledged them? Have you checked a sample of off site workers and offsite workers to see if the controls are being followed? Check!
• Your document and version control is wrong: Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

Applicability of ISO 27001 Annex A 7.9 across different business models.

Business Type	Applicability	Examples of Control Implementation
Small Businesses	Highly applicable for protecting laptops and phones in a hybrid work environment. The focus is on common-sense theft prevention and ensuring that staff are equipped with the knowledge to protect equipment while traveling.	Providing staff with a “Public Space Security Checklist” that includes rules like never leaving a laptop unattended in a coffee shop. Setting a mandatory policy to lock all company devices in the car boot/trunk before arriving at a destination. Enforcing full-disk encryption (BitLocker/FileVault) on all laptops to ensure data remains unreadable if the asset is stolen off-premises.
Tech Startups	Critical for protecting proprietary source code and customer data accessed by distributed teams. Focus is on technical remote management and protecting work in public co-working spaces.	Distributing physical privacy screen filters to all developers to prevent “shoulder surfing” on trains or in open-plan co-working offices. Using Mobile Device Management (MDM) to enable remote “Lock and Wipe” capabilities for any laptop reported lost or stolen. Mandating that all off-site work involving sensitive data is performed via a secure VPN or Zero-Trust Network Access (ZTNA) gateway.
AI Companies	Vital for protecting specialized high-performance endpoints that access expensive GPU clusters. Focus is on ensuring that the “keys to the kingdom” (SSH keys and session tokens) are not compromised off-site.	Enforcing the use of hardware security keys (e.g., YubiKeys) for all remote administrative access to AI training environments. Implementing “Geofencing” alerts that notify the security team if a high-value research laptop is taken outside of authorized geographic regions. Requiring that proprietary model weights are never downloaded to local endpoint storage, ensuring data stays within the secure cloud perimeter.

Fast Track ISO 27001 Annex A 7.9 Compliance with the ISO 27001 Toolkit

For ISO 27001 Annex A 7.9 (Security of assets off-premises), the requirement is to protect equipment and assets even when they are not in an environment you control. This is a mix of common-sense physical security (e.g., not leaving laptops in cars) and human education.

Compliance Factor	SaaS Compliance Platforms	High Table ISO 27001 Toolkit	Audit Evidence Example
Data & Policy Ownership	Rents access to your standards; if you cancel, your documented off-site rules and history vanish.	Permanent Assets: Fully editable Word/Excel Physical Security Policies that you own forever.	A localized “Off-Site Asset Policy” defining hotel safe protocols and car storage rules.
Simplicity & Education	Attempts to “monitor” behavior via dashboards that cannot physically prevent theft or shoulder surfing.	Governance-First: Formalizes employee training and hybrid work culture into an auditor-ready framework.	A signed “Public Space Security Checklist” completed by remote employees during security inductions.
Cost Efficiency	Charges a “Remote Worker Tax” based on the number of off-site employees or mobile assets tracked.	One-Off Fee: A single payment covers your governance documentation for 5 remote workers or 500.	Allocating budget to physical security hardware (e.g., privacy filters) rather than monthly software fees.
Strategic Freedom	Mandates rigid reporting that may not align with modern, flexible hybrid or digital nomad work models.	100% Agnostic: Procedures adapt to any environment—home offices, co-working spaces, or travel.	The ability to evolve your remote work strategy without reconfiguring a rigid SaaS compliance module.

Summary: For Annex A 7.9, the auditor wants to see that you have a formal policy for off-site security and proof that you educate your staff on it (e.g., training records and checklists). The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.

ISO 27001 Annex A 7.9 FAQ

ISO 27001 Controls and Attribute Values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Confidentiality	Protect	Physical Security	Protection
	Integrity		Asset management
	Availability