7.9 Security of assets off-premises
Assets taken or located off-site are to be protected. Purpose: stop devices used away from the premises from being lost, stolen, damaged or compromised, and avoid the operational disruption that would cause. Guidance: any device used outside the premises that stores or processes information, whether owned by the organization or privately owned and used for its work (BYOD), needs protection, and its use is authorized by management. For such devices consider: never leaving equipment or media unattended in public or insecure places; following manufacturers' protection instructions, for example against strong electromagnetic fields, water, heat, humidity and dust; keeping a chain-of-custody log naming the people and organizations responsible when off-site equipment passes between parties, and securely deleting information that need not travel with it; requiring authorization, where needed and practical, for removing equipment and media from the premises and recording removals as an audit trail (5.14); guarding against others viewing screens on public transport and against shoulder surfing; and location tracking with remote wipe. Equipment permanently installed off-site, such as antennas or cash machines, faces higher and location-dependent risk of damage, theft or eavesdropping, so consider physical security monitoring (7.4), protection against physical and environmental threats (7.5), physical access and tamper-proofing controls, and logical access controls. Other information: 8.1 and 6.7 cover further aspects of endpoint and remote equipment protection.
Source: ISO/IEC 27002:2022, 7.9. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Removal authorization and audit trail for equipment and media leaving the premises · Physical access / facilities
- Chain-of-custody logs for off-site equipment passed between people or organizations, with records of data deleted before transfer · Physical access / facilities
- Device management configuration showing location tracking and remote wipe capability · Physical access / facilities
periodic reviewEvidence produced at each review
- Management authorization records for use of organization-owned and BYOD devices off-site · Physical access / facilities
- Physical and logical protection records for permanently installed off-site equipment such as tamper seals and monitoring · Physical access / facilities
governing documentDocuments that govern the control
- Guidance to personnel on not leaving equipment unattended, manufacturer protection instructions and shoulder surfing · Policy repository / GRC workspace
First move
Common gaps auditors find
- BYOD devices are used for work without management authorization or any control
- No record exists of which equipment is off-site or with whom
- Remote wipe is not enabled, so a lost laptop cannot be neutralized
- Unattended off-site equipment such as kiosks lacks tamper detection
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet