ISO 27001:2022 Annex A 7.9 Security of assets off-premises

In this guide, I will show you exactly how to implement ISO 27001 Annex A 7.9 and ensure you pass your audit. You will get a complete walkthrough of the control, practical implementation examples, and access to the ISO 27001 templates and toolkit that make compliance easy.

I am Stuart Barker, an ISO 27001 Lead Auditor with over 30 years of experience conducting hundreds of audits. I will cut through the jargon to show you exactly what changed in the 2022 update and provide you with plain-English advice to get you certified.

Key Takeaways: ISO 27001 Annex A 7.9 Security of Assets Off-Premises

ISO 27001 Annex A 7.9 requires organizations to protect off-site assets (laptops, phones, portable drives) from loss, theft, or compromise. In a modern remote-work economy, you no longer control the physical environment where your equipment is used. The goal of this control is to bridge that gap by equipping employees with the right tools, policies, and training to maintain security while working from homes, cafes, or during travel.

Core requirements for compliance include:

• Risk-Based Protection: You must identify the unique threats of off-site work (e.g., theft from cars, public Wi-Fi hacking, or “shoulder surfing”) and implement proportionate controls.
• Mandatory Encryption: All off-premises devices containing sensitive data must be encrypted. If a laptop is stolen from a car, the data remains unreadable.
• Physical Security Training: Employees must be explicitly trained on how to handle equipment in public. This includes rules like “never leave a laptop unattended in a coffee shop” and “lock devices in the hotel safe.”
• Remote Management (MDM): You should have the technical ability to remotely lock or wipe a device if it is reported stolen, ensuring that company data doesn’t remain on an at-risk asset.
• Authorization & Inventory: While modern work is flexible, you must still track which assets are off-premises and ensure that only authorized equipment is used to access company systems.

Audit Focus: Auditors will look for “The Human Element”:

1. Policy Acknowledgement: “Show me that your remote workers have read and signed your ‘Mobile Device & Off-Site Work’ policy.”
2. Screen Sharing Check: During a remote audit, an auditor may ask a worker: “If you were working in a cafe right now, what physical tools (like a privacy screen) would you use to protect your work?”
3. The Wipe Test: “Show me the record of the last time a device was lost. Did you successfully wipe the data remotely?”

Public Space Security Checklist (Audit Prep):

Scenario	Risk	Required ISO 27001 Action
In a Car	Theft (Smash & Grab).	Lock in the trunk/boot before arriving at your destination.
Coffee Shop	Theft (Snatch & Run).	Never leave the device unattended, even for a minute.
Train / Plane	Shoulder Surfing.	Use a Privacy Screen Filter and position the screen away from others.
Hotel Room	Unauthorized Access.	Lock the device in the room safe or keep it on your person.

What is ISO 27001 Annex A 7.9?

The focus for this ISO 27001 Control is your assets. As one of the ISO 27001 controls this is about the protection of those assets when not in an environment you control.

ISO 27001 Annex A 7.9 Security of assets off-premises is an ISO 27001 control that looks to protect equipment by siting it securely and protecting it.

ISO 27001 Annex A 7.9 Purpose

The purpose of ISO 27001 Security Of Assets Off-Premises is to prevent loss, damage, theft or compromise of off-site devices and interruption to the organisations operations..

ISO 27001 Annex A 7.9 Definition

The ISO 27001 standard defines ISO 27001 Annex A 7.9 as:

Off-site assets should be protected.

ISO 27001:2022 Annex A 7.9 Security of assets off-premises

ISO 27001 Annex A 7.9 Free Training Video

In the video ISO 27001 Security of Assets Off Premises Explained – ISO27001:2022 Annex A 7.9 I show you how to implement it and how to pass the audit.

ISO 27001 Annex A 7.9 Explainer Video

In this beginner’s guide to ISO 27001 Annex A 7.9 Security Of Assets Off-Premises, ISO 27001 Lead Auditor Stuart Barker and his team talk you through what it is, how to implement in and how to pass the audit. Free ISO 27001 training.

ISO 27001 Annex A 7.9 Podcast

In this episode: Lead Auditor Stuart Barker and team do a deep dive into the ISO 27001 Annex A 7.9 Security Of Assets Off-Premises. The podcast explores what it is, why it is important and the path to compliance.

How to implement ISO 27001 Annex A 7.9

General Guidance

Well in this modern world people take their equipment of site. This used to be a massive thing a few years ago when everyone was chained to an office and all the equipment stayed at the office. Taking things off site was such a palaver, with forms and authorisation and massive forklift trucks to move those ‘laptops’. Things have moved on but the control remains now with a more general focus on the protection of assets off site. Rather than the process of authorising it.

Education and Training

Like much of the standard we are looking at common sense really when it comes to this control. There is a combination of telling people what is expected, training them, educating them and also where possible putting some technical controls in place if they help reduce risk.

Off Site Protection

We always want to protect what is important to us so in this situation we are looking at what are the threats that can be posed by having assets in an environment that we do not control and therefore what are things we can do to address those threats.

Public Areas

Simple things like not having assets left unattended in public areas. Seems to make sense but we have all seen people leave laptops open in bars, restaurants and on trains whilst they go and ‘use the facilities’.

Shoulder Surfing

There is a lot of shoulder surfing that goes on as well. People reading over your shoulder or between the gaps in train and aeroplane seats. We all like to be nosey, am I right? We can do things like be conscious of it and position ourselves so as not to facilitate it and we can consider the use of privacy screens and screen protectors. What ever works for you.

Related Controls

There are a couple of other controls worth reading up here as well being ISO 27001 Annex A 6.7 Remote Working and ISO 27001 Annex A 8.1 User End Point Devices.

Public Space Security Checklist

Scenario	Risk	Required Action
In a Car	Theft (Smash & Grab)	Lock in the Boot/Trunk before parking.
Coffee Shop	Theft (Snatch)	Never leave device unattended (even for 1 min).
Train/Plane	Shoulder Surfing	Use a Privacy Screen Filter.
Hotel Room	Cleaning Staff Access	Lock in the Room Safe when out.

ISO 27001 Templates

For Annex A 7.9 Security Of Assets Off-Premises you need a topic specific Physical and Environmental Security Policy Template.

Having ISO 27001 templates can help fast track your ISO 27001 implementation. The ISO 27001 Toolkit is the ultimate resource for your ISO 27001 certification.

How to comply

To comply with ISO 27001 Annex A 7.9 Security Of Assets Off-Premises you are going to

• Train, educate, tell and communicate to people what is expected of them
• Assess you assets and perform a risk assessment
• Implement controls proportionate to the risk posed
• Test the controls that you have to make sure they are working

Top 3 ISO 27001 Annex A 7.9 mistakes and how to avoid them

The top 3 mistakes people make for ISO 27001 Annex A 7.9 Security Of Assets Off-Premises are

1. You haven’t told people what is expected

It is really hard to control assets when you don’t control the environment that they are in. You cannot account for every situation and variable but you can equip people with the knowledge to make the right choices and the tools to reduce the risks. If you don’t communicate and educate and inform then this control will fail.

2. One or more members of your team haven’t done what they should have done

Prior to the audit check that all members of the team have done what they should have. Do they know where the policies are? Have they acknowledged them? Have you checked a sample of off site workers and offsite workers to see if the controls are being followed? Check!

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

Fast Track Compliance with the ISO 27001 Toolkit

---

---

For ISO 27001 Annex A 7.9 (Security of assets off-premises), the requirement is to protect equipment and assets even when they are not in an environment you control. This is a mix of common-sense physical security (e.g., not leaving laptops in cars) and human education.

While SaaS compliance platforms often try to sell you “automated off-site asset trackers” or complex monitoring modules, they cannot actually lock your laptop in a car boot or stop someone from “shoulder surfing” on a train, they are merely a place to host your documentation. The High Table ISO 27001 Toolkit is the logical choice because it provides the governance layer that defines these rules, allowing you to manage off-site security effectively without a recurring subscription fee.

1. Ownership: You Own Your Off-Site Security Policy Forever

SaaS platforms act as a middleman for your compliance evidence. If you define your off-site security rules and store your training logs inside their proprietary system, you are essentially renting your own security standards.

• The Toolkit Advantage: You receive the Physical and Environmental Security Policy and Public Space Security Checklist in standard Word/Excel formats. These files are yours forever. You maintain permanent ownership of your standards (such as hotel room safe protocols), ensuring you are always ready for an audit without an ongoing “rental” fee.

2. Simplicity: Governance for Real-World Scenarios

Annex A 7.9 is about educating people on how to behave when off-site. You don’t need a complex new software interface to manage what your employees already know (or should know) about common-sense theft prevention.

• The Toolkit Advantage: Your team already knows they shouldn’t leave a laptop on a coffee shop table. What they need is the governance layer to prove to an auditor that these expectations are formal, communicated, and part of the organizational culture. The Toolkit provides the pre-written policies and “Public Space Security Checklists” that formalize your existing training work into an auditor-ready framework, without forcing your team to learn a new software platform.

3. Cost: A One-Off Fee vs. The “Remote Worker” Tax

Many compliance SaaS platforms charge more as the number of “remote assets” or “off-site employees” increases. For a control that applies to every mobile worker in your company, these monthly costs can scale aggressively.

• The Toolkit Advantage: You pay a single, one-off fee for the entire toolkit. Whether you have 5 remote workers or 500, the cost of your Off-Site Asset Documentation remains the same. You save your budget for actual security hardware (like privacy screens or encrypted drives) rather than an expensive compliance dashboard.

4. Freedom: No Vendor Lock-In for Your Security Strategy

SaaS tools often mandate specific ways to track and report on off-site assets. If their system doesn’t match your modern, flexible hybrid work model, the tool becomes a bottleneck.

• The Toolkit Advantage: The High Table Toolkit is 100% technology-agnostic and fully editable. You can tailor the Security Procedures to match exactly how your team works, whether they are in co-working spaces, trains, or home offices. You maintain total freedom to evolve your remote work strategy without being constrained by the technical limitations of a rented SaaS platform.

Summary: For Annex A 7.9, the auditor wants to see that you have a formal policy for off-site security and proof that you educate your staff on it (e.g., training records and checklists). The High Table ISO 27001 Toolkit provides the governance framework to satisfy this requirement immediately. It is the most direct, cost-effective way to achieve compliance using permanent documentation that you own and control.

ISO 27001 Controls and Attribute Values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Confidentiality	Protect	Physical Security	Protection
	Integrity		Asset management
	Availability

About the author

Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.

Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.

As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.

His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.