ISO 27001 Security of Assets Off-Premises
ISO 27001 Annex A 7.9 Security of assets off-premises is an ISO 27001 control that is about the protection of those assets when not in an environment you control.
Table of contents
- ISO 27001 Security of Assets Off-Premises
- Key Takeaways
- Purpose
- Definition
- Explanation
- Requirement
- Audit Focus
- FREE Training Video
- Guidance
- Education and Training
- Off Site Protection
- Public Areas
- Shoulder Surfing
- How to implement it
- Related Controls
- Public Space Security Checklist
- ISO 27001 Templates
- How to comply
- Top 3 mistakes and how to avoid them
- Applicability across different business models
- FAQ
- ISO 27001 Controls and Attribute Values
- About the author
Key Takeaways
ISO 27001 Annex A 7.9 requires organizations to protect off-site assets (laptops, phones, portable drives) from loss, theft, or compromise. In a modern remote-work economy, you no longer control the physical environment where your equipment is used. The goal of this control is to bridge that gap by equipping employees with the right tools, policies, and training to maintain security while working from homes, cafes, or during travel.
Purpose
The purpose of ISO 27001 Security Of Assets Off-Premises is to prevent loss, damage, theft or compromise of off-site devices and interruption to the organisations operations..
Definition
The ISO 27001 standard defines ISO 27001 Annex A 7.9 as:
Off-site assets should be protected.
ISO 27001:2022 Annex A 7.9 Security of assets off-premises
Explanation
ISO 27001 Annex A 7.9 Security of Assets Off-Premises is a security control that mandates the protection of hardware and information outside the organization’s physical perimeter. It requires risk-based safeguards, such as full-disk encryption and physical supervision, to prevent theft, loss, or unauthorized access, ensuring business continuity during remote work operations.
Requirement
- Risk-Based Protection: You must identify the unique threats of off-site work (e.g., theft from cars, public Wi-Fi hacking, or “shoulder surfing”) and implement proportionate controls.
- Mandatory Encryption: All off-premises devices containing sensitive data must be encrypted. If a laptop is stolen from a car, the data remains unreadable.
- Physical Security Training: Employees must be explicitly trained on how to handle equipment in public. This includes rules like “never leave a laptop unattended in a coffee shop” and “lock devices in the hotel safe.”
- Remote Management (MDM): You should have the technical ability to remotely lock or wipe a device if it is reported stolen, ensuring that company data doesn’t remain on an at-risk asset.
- Authorization & Inventory: While modern work is flexible, you must still track which assets are off-premises and ensure that only authorized equipment is used to access company systems.
Audit Focus
- Policy Acknowledgement: “Show me that your remote workers have read and signed your ‘Mobile Device & Off-Site Work’ policy.”
- Screen Sharing Check: During a remote audit, an auditor may ask a worker: “If you were working in a cafe right now, what physical tools (like a privacy screen) would you use to protect your work?”
- The Wipe Test: “Show me the record of the last time a device was lost. Did you successfully wipe the data remotely?”
FREE Training Video
In this free training video you will learn How to implement ISO 27001 Security of Assets Off Premises (Annex A 7.9) and Pass Your Audit.
Guidance
Well in this modern world people take their equipment of site. This used to be a massive thing a few years ago when everyone was chained to an office and all the equipment stayed at the office. Taking things off site was such a palaver, with forms and authorisation and massive forklift trucks to move those ‘laptops’. Things have moved on but the control remains now with a more general focus on the protection of assets off site. Rather than the process of authorising it.
Education and Training
Like much of the standard we are looking at common sense really when it comes to this control. There is a combination of telling people what is expected, training them, educating them and also where possible putting some technical controls in place if they help reduce risk.
Off Site Protection
We always want to protect what is important to us so in this situation we are looking at what are the threats that can be posed by having assets in an environment that we do not control and therefore what are things we can do to address those threats.
Public Areas
Simple things like not having assets left unattended in public areas. Seems to make sense but we have all seen people leave laptops open in bars, restaurants and on trains whilst they go and ‘use the facilities’.
Shoulder Surfing
There is a lot of shoulder surfing that goes on as well. People reading over your shoulder or between the gaps in train and aeroplane seats. We all like to be nosey, am I right? We can do things like be conscious of it and position ourselves so as not to facilitate it and we can consider the use of privacy screens and screen protectors. What ever works for you.
How to implement it
Implementing ISO 27001 Annex A 7.9 requires a rigorous framework to ensure that organisational equipment and information remain protected when removed from secure perimeters. This technical guide outlines the action-result workflow for managing off-premises assets, mitigating risks such as physical theft, visual interception, and unauthorised data access.
1. Formalise Asset Removal Authorisation and Accountability
Establish a documented approval process for any asset leaving the secure site to ensure all movements are tracked and assigned to a responsible individual.
- Update the central Asset Register to reflect the current location and temporary owner of the hardware.
- Define clear time limits for off-site usage to prevent assets from remaining outside the secure perimeter indefinitely.
- Require users to sign an Acceptable Use Policy (AUP) that specifically addresses off-site security responsibilities.
- Implement a digital sign-out workflow to maintain a timestamped audit trail for compliance reviews.
2. Provision Technical Safeguards and Data Encryption
Apply robust technical controls to the hardware to ensure that data remains inaccessible even if the physical device is compromised.
- Enforce Full Disk Encryption (FDE) using AES-256 standards on all laptops and portable storage devices.
- Configure Multi-Factor Authentication (MFA) for all system logins to prevent unauthorised access via stolen credentials.
- Deploy a Virtual Private Network (VPN) or Zero Trust Network Access (ZTNA) to secure data in transit over public Wi-Fi.
- Verify that endpoint protection and antivirus definitions are updated automatically regardless of the device location.
3. Establish Physical Handling and Transit Protocols
Implement strict physical security rules to protect assets from opportunistic theft or damage during travel and usage in public spaces.
- Prohibit the storage of organisational equipment in unattended vehicles or unsecured hotel rooms.
- Issue privacy filters for screens to mitigate the risk of visual eavesdropping or shoulder surfing in public environments.
- Mandate the use of padded, non-descript carrying cases to reduce the visibility of high-value equipment and prevent transit damage.
- Establish a “Line of Sight” rule requiring users to maintain physical control of assets in high-risk areas like airports or cafes.
4. Log and Monitor via Mobile Device Management
Utilise centralised management software to maintain visibility and control over equipment that is no longer within the local network.
- Enrol all off-site assets into a Mobile Device Management (MDM) or Unified Endpoint Management (UEM) solution.
- Configure remote wipe capabilities to delete all sensitive data immediately upon report of loss or theft.
- Enable “Find My Device” tracking features to assist in asset recovery or to verify the device’s last known location.
- Monitor device compliance status to ensure that security patches and encryption remain active while off-site.
5. Formalise Incident Reporting and Access Revocation
Prepare a rapid response protocol to minimise the impact of a lost or stolen off-premises asset.
- Define a maximum time window for users to report lost or stolen equipment to the security team.
- Revoke logical access and IAM roles immediately upon notification of a lost device to prevent secondary network breaches.
- Document every off-site asset incident within the ISMS incident log for trend analysis and audit evidence.
- Instruct users to change all personal and professional passwords if a device containing saved credentials is compromised.
Related Controls
There are a couple of other controls worth reading up here as well being ISO 27001 Annex A 6.7 Remote Working and ISO 27001 Annex A 8.1 User End Point Devices.
Public Space Security Checklist
| Scenario | Risk | Required Action |
| In a Car | Theft (Smash & Grab) | Lock in the Boot/Trunk before parking. |
| Coffee Shop | Theft (Snatch) | Never leave device unattended (even for 1 min). |
| Train/Plane | Shoulder Surfing | Use a Privacy Screen Filter. |
| Hotel Room | Cleaning Staff Access | Lock in the Room Safe when out. |
ISO 27001 Templates
For Annex A 7.9 Security Of Assets Off-Premises you need a topic specific Physical and Environmental Security Policy Template.
Having ISO 27001 templates can help fast track your ISO 27001 implementation. The ISO 27001 Toolkit is the ultimate resource for your ISO 27001 certification.
How to comply
To comply with ISO 27001 Annex A 7.9 Security Of Assets Off-Premises you are going to
- Train, educate, tell and communicate to people what is expected of them
- Assess you assets and perform a risk assessment
- Implement controls proportionate to the risk posed
- Test the controls that you have to make sure they are working
Top 3 mistakes and how to avoid them
The top 3 mistakes people make for ISO 27001 Annex A 7.9 Security Of Assets Off-Premises are
- You haven’t told people what is expected: It is really hard to control assets when you don’t control the environment that they are in. You cannot account for every situation and variable but you can equip people with the knowledge to make the right choices and the tools to reduce the risks. If you don’t communicate and educate and inform then this control will fail.
- One or more members of your team haven’t done what they should have done: Prior to the audit check that all members of the team have done what they should have. Do they know where the policies are? Have they acknowledged them? Have you checked a sample of off site workers and offsite workers to see if the controls are being followed? Check!
- Your document and version control is wrong: Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
Applicability across different business models
| Business Type | Applicability | Examples of Control Implementation |
|---|---|---|
| Small Businesses | Highly applicable for protecting laptops and phones in a hybrid work environment. The focus is on common-sense theft prevention and ensuring that staff are equipped with the knowledge to protect equipment while traveling. |
|
| Tech Startups | Critical for protecting proprietary source code and customer data accessed by distributed teams. Focus is on technical remote management and protecting work in public co-working spaces. |
|
| AI Companies | Vital for protecting specialized high-performance endpoints that access expensive GPU clusters. Focus is on ensuring that the “keys to the kingdom” (SSH keys and session tokens) are not compromised off-site. |
|
FAQ
Securing assets off-premises involves a combination of formal authorisation, technical safeguards, and strict physical handling procedures to prevent unauthorised access.
Authorisation: Log every asset taken off-site in an asset register.
Encryption: Enforce Full Disk Encryption (FDE) on all portable devices.
Supervision: Maintain physical control of the device in public spaces at all times.
Insurance: Ensure the organisation’s insurance covers off-site usage and transit.
Yes, while ISO 27001 is technology-neutral, encryption is considered a mandatory technical control to protect data confidentiality on assets located off-premises.
Prevents data access if a laptop or phone is stolen.
Supports compliance with data protection laws like GDPR.
Allows for secure remote wipes if the device is lost.
Protects both internal storage and removable media.
No, leaving company assets unattended in a vehicle is generally prohibited under ISO 27001 policies due to the high risk of opportunistic theft.
Assets should never be left in a car overnight.
If temporary storage is unavoidable, assets must be locked in the boot and out of sight.
Physical control must be prioritised during transit.
Hotel safes should be used instead of vehicles during travel.
The primary risks of using assets in public environments include visual eavesdropping (shoulder surfing), physical theft, and interception via insecure networks.
Shoulder Surfing: Unauthorised viewing of sensitive data on the screen.
Theft: High risk of snatch-and-grab theft in cafes or transport hubs.
Insecure Wi-Fi: Interception of data via “Man-in-the-Middle” attacks.
Distraction: Loss of situational awareness leading to equipment misplacement.
The individual user is primarily responsible for the physical security and correct usage of an asset once it has been authorised for removal from company premises.
Users must follow the Acceptable Use Policy (AUP).
Immediate reporting of loss or theft to the IT/Security team is required.
Users must ensure assets are not used by family members or unauthorised persons.
Adherence to transport and storage guidelines is a condition of authorisation.
ISO 27001 Controls and Attribute Values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Confidentiality | Protect | Physical Security | Protection |
| Integrity | Asset management | |||
| Availability |
About the author
