Security of assets off-premises

What the requirement asks

Assets taken or located off-site are to be protected. Purpose: stop devices used away from the premises from being lost, stolen, damaged or compromised, and avoid the operational disruption that would cause. Guidance: any device used outside the premises that stores or processes information, whether owned by the organization or privately owned and used for its work (BYOD), needs protection, and its use is authorized by management. For such devices consider: never leaving equipment or media unattended in public or insecure places; following manufacturers' protection instructions, for example against strong electromagnetic fields, water, heat, humidity and dust; keeping a chain-of-custody log naming the people and organizations responsible when off-site equipment passes between parties, and securely deleting information that need not travel with it; requiring authorization, where needed and practical, for removing equipment and media from the premises and recording removals as an audit trail (5.14); guarding against others viewing screens on public transport and against shoulder surfing; and location tracking with remote wipe. Equipment permanently installed off-site, such as antennas or cash machines, faces higher and location-dependent risk of damage, theft or eavesdropping, so consider physical security monitoring (7.4), protection against physical and environmental threats (7.5), physical access and tamper-proofing controls, and logical access controls. Other information: 8.1 and 6.7 cover further aspects of endpoint and remote equipment protection. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Assets off premises need protection in transit and at the destination. The guidance asks for the authorisation, the protection, the record and the return.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep management authorization records for use of organization-owned and BYOD devices off-site and one live sample together.

Evidence an assessor asks for

• Off-premises assetsManagement authorization records for use of organization-owned and BYOD devices off-site
• Off-premises assetsRemoval authorization and audit trail for equipment and media leaving the premises
• Off-premises assetsChain-of-custody logs for off-site equipment passed between people or organizations, with records of data deleted before transfer
• Off-premises assetsDevice management configuration showing location tracking and remote wipe capability
• Off-premises assetsGuidance to personnel on not leaving equipment unattended, manufacturer protection instructions and shoulder surfing
• Off-premises assetsPhysical and logical protection records for permanently installed off-site equipment such as tamper seals and monitoring

The question an assessor will ask

An assessor will ask for management authorization records for use of organization-owned and BYOD devices off-site, then trace it to the system it protects. For A.7.9 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• BYOD devices are used for work without management authorization or any control
• No record exists of which equipment is off-site or with whom
• Remote wipe is not enabled, so a lost laptop cannot be neutralized
• Unattended off-site equipment such as kiosks lacks tamper detection

Before the next audit

Before the next audit, check one live sample for this gap: byod devices are used for work without management authorization or any control.