Return of assets

What the requirement asks

When their employment, contract or agreement changes or ends, staff and, where relevant, other interested parties are to hand back every organizational asset they hold. Purpose: protect the organization's assets during the change or termination process. Guidance: the change or exit process should formally include recovery of all physical and electronic assets issued to the person, whether the organization owns them or holds them in trust. Where people buy organizational equipment or used their own devices, procedures should make sure relevant information is traced, moved to the organization and securely wiped from the device (7.14). Knowledge held by the person that matters for ongoing operations should be documented and handed over. During the notice period and afterwards the organization should stop people who are leaving from copying relevant information, such as intellectual property, without authorization. The assets to be returned should be identified and documented, and can include user endpoint devices, portable storage, specialist equipment, authentication hardware for systems, sites and archives (keys, tokens, smartcards) and paper copies of information. Other information: information on assets the organization does not own is hard to recover, so its use should be limited through other measures, for instance managing access rights (5.18) or cryptography (8.24). In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Return of assets is a transition control. The guidance asks for the asset list at exit, the return record, the date and the person who confirmed it.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the leaver and mover procedure with an asset return step and a checklist of assets issued to each person and one live sample together.

Evidence an assessor asks for

• Leaver and mover processThe leaver and mover procedure with an asset return step and a checklist of assets issued to each person
• Leaver and mover processSigned asset return records reconciled against the asset inventory
• Leaver and mover processRecords of information transferred from and securely wiped on personally owned or purchased devices
• Leaver and mover processKnowledge transfer or handover documentation for departing staff holding operationally important knowledge
• Leaver and mover processEvidence of monitoring or technical restrictions on copying data during notice periods
• Leaver and mover processReturn records for authentication hardware such as keys, tokens and smartcards

The question an assessor will ask

An assessor will ask for the leaver and mover procedure with an asset return step and a checklist of assets issued to each person, then trace it to the system it protects. For A.5.11 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Asset return is not reconciled against what was issued, so missing items go unnoticed
• BYOD devices of leavers still hold organizational data
• Nothing prevents bulk downloads by staff under notice
• Contractors and third-party staff are excluded from the return process

Before the next audit

Before the next audit, check one live sample for this gap: asset return is not reconciled against what was issued, so missing items go unnoticed.