A.7.9 Security of assets off-premises: evidence guide

What does A.7.9 security of assets off-premises require in practice?

Laptops, phones, tablets, removable media and other equipment leave the building every day: on trains, in home offices, in client sites and in hotel rooms. A.7.9 Security of assets off-premises asks the organization to protect these assets while they are used or kept outside its premises, so that they are not lost, damaged, stolen or compromised and so that operations are not interrupted. The control does not care where the device came from. A company laptop, a personal phone used for email and a USB drive carrying customer files all fall within what the organization must account for. The 2013 edition handled the same concern under A.11.2.6 Security of equipment and assets off-premises, which ISO/IEC 27002:2022 Annex B traces to the current control. Organizations that already had a rule for this under the older numbering can usually reuse much of it, but they should confirm that the wording and ownership still match the 2022 control.

The control is hard to meet for three recurring reasons. First, off-site equipment rarely has a single owner. IT may hold the asset register, facilities may handle loss of property, and line managers may be the people who notice when a device is missing, so nobody is clearly responsible for custody. Second, personal devices used for work blur the asset boundary. The organization must decide which personal devices are in scope, how they are enrolled or managed, and what happens when an employee leaves. Third, home-working gaps are easy to miss. Remote working is a separate control (A.6.7), but its physical side, such as where equipment is stored at home, who else can use it and how it is transported, lands squarely in A.7.9. A practical first step is to ask who owns the off-site asset register, which devices are allowed off-site, and how a loss is reported within the first hours.

An assessor will usually look for a documented rule on taking assets off-site, a current record of which assets are out, the controls applied to them (encryption, screen locks, transport and storage expectations) and evidence that losses are reported and handled. Inventory tooling helps here. GLPI can track computers, peripherals and other equipment with their assigned users, and the Wazuh Syscollector module reports hardware and software from enrolled endpoints, which lets the organization show what a device contains and whether it is still reporting. Confirm with your own environment whether devices that are off-network report inventory data, because a gap there is exactly the blind spot the control is meant to close.

Which off-site assets and teams fall under A.7.9 scope?

A.7.9 covers any asset the organization uses or keeps outside its premises, and each place an asset travels changes who owns it, how it is protected and what evidence an assessor will ask for. The cards below separate the scoping decisions most organizations must make, so the control boundary is drawn before the controls are written.

Company laptops and phones off-site

Laptops and phones taken home, to client sites or on travel are the most common A.7.9 assets. Decide which device classes are in scope, whether personal devices used for work are included, and how each device is registered before it leaves the building. Check that full-disk encryption, screen locks and remote wipe are enforced on every in-scope device, and that the asset register records the current holder. Confirm with the assessor whether personal devices fall in the ISMS scope.

Removable media in transit

USB drives, external disks and optical media carried between sites are assets off-premises even when they hold only a few files. Define which media may leave the premises, who authorizes each movement and what encryption applies. Record custody at each handover, because an auditor will ask how a missing drive would be traced. Media disposal and sanitization are covered under A.7.10, so note where transit rules end and storage media rules begin.

Equipment held by staff or contractors

Equipment issued to contractors, consultants, field engineers or temporary staff sits within A.7.9 even when the organization does not employ the holder. Decide which contracts require return of equipment, how loss is reported and who keeps the asset record for borrowed devices. Contractors who hold equipment also touch the supplier controls in A.5.19 to A.5.22, so confirm which team owns each obligation before the contract is signed.

Cloud and backup copies that leave the premises

Data copies held in cloud storage, offsite backups or replicated sites are not devices, but they are assets stored away from the organization's premises. Decide which copies count as in scope, where they are held and which encryption and key custody rules apply. Self-hosted platforms in a provider's data center or a second site need the same custody questions as a laptop. Confirm with the assessor how replicas and backup tapes are inventoried and retrieved.

Mapping to NIST SP 800-53 controls

NIST's crosswalk from SP 800-53 Rev. 5 to ISO/IEC 27001:2022, posted to the OLIR catalog in November 2023, relates A.7.9 to AC-19 (Access Control for Mobile Devices), AC-20 (Use of External Systems), MP-5 (Media Transport) and PE-17 (Alternate Work Site). NIST cautions that mapped controls are not always equivalent, so treat this as a starting point for your own evidence. Confirm any mapping with the assessor before relying on it in the Statement of Applicability.

Drawing the boundary with A.6.7 and A.8.1

A.6.7 Remote working covers the arrangements that let staff work from outside the office, while A.8.1 User endpoint devices covers the protection of devices that users hold. A.7.9 covers the physical custody and transport of the asset itself. Write down which control owns each rule, such as encryption in A.8.1, home working conditions in A.6.7 and custody during travel in A.7.9, so the same laptop is not evidenced three times with inconsistent records.

How an assessor tests A.7.9 security of assets off-premises

This table lists each test step an assessor typically takes for A.7.9, the evidence requested for that step and the findings that most often lead to nonconformities. Read it as a sampling plan: the assessor picks devices and media that have left the site, then traces each one back through the register, custody records, transport rules, loss reporting and device settings. Gaps in any one step usually surface during the trace.

Test step	Evidence requested	Common findings
Review the off-site asset policy and register	Written rules for taking assets off-premises, the asset register with off-site status, and the owner for each record	Register omits laptops and removable media issued to staff; policy exists but names no owner or review date
Sample off-site assets and trace custody	Selected devices and media from the register, with checkout records, current holder and return or transfer history	No record of who holds a device; holder changed without an update; assets listed as on-site that an assessor finds off-site
Check transport and travel rules	Travel or home-use approvals, carrying and storage instructions, and records of exceptions such as devices left in vehicles	Rules cover company premises only; staff travel with devices unattended; no approval trail for international travel
Review loss and theft reports and their follow-up	Incident tickets for lost or stolen assets, with timestamps, containment actions, data impact assessment and closure notes	Loss reports with no closure; no link to the register so the asset stays marked as held; reports filed late without explanation
Check encryption and lock settings on sampled devices	Disk encryption status, screen lock and auto-lock settings, and remote wipe or tracking status exported from management tooling	Encryption disabled on a sampled laptop; screen lock set beyond the policy limit; devices absent from the management console
Confirm the register matches the sampled devices	Reconciliation between inventory tool output, the off-site register and the devices physically sampled	Serial numbers differ between records; devices in the console but missing from the register; duplicate entries for one device
Interview the custodians	Short statements from sampled staff on what they carry, where they store it and how they report loss	Staff unaware of the reporting route; personal storage of work media not covered by any rule

Implementing off-premises asset controls step by step

This sequence moves from deciding which assets may leave the premises to proving, through periodic checks, that the rules still hold for devices and media in use off-site. Each step closes with a named artifact an auditor can review.

Define which asset classes may leave premises
Start by listing the asset classes your organization allows off-site, such as company laptops, phones, tablets, removable media and paper records, and the classes that must never leave. Assign the decision to a named owner, usually the information security lead with input from operations and the data owners. Link each class to the classification scheme you already use for information, so that more sensitive data sets have stricter off-site limits. The step closes with an approved off-premises asset policy or a section in your existing asset handling standard, signed off by management.
Build and clean the asset register
Create or correct the inventory of every asset in the approved classes, recording the device owner, serial number, assigned user, classification of data it holds and its normal location. Tools such as GLPI can hold this register, and an endpoint agent can populate hardware and software records automatically, which reduces manual gaps. Reconcile the register against directory accounts and device management records to find unknown or orphaned devices. The output is a reviewed register with a documented reconciliation date and a list of exceptions with owners.
Set custody and transport rules by classification
Write the rules for how each asset class is taken off-site, carried, stored at home or while traveling, and returned. Cover who may approve removal, whether assets may be left in vehicles or unattended in public places, how media is sealed or tracked in transit, and which data may be accessed remotely rather than copied to a device. Align these rules with your remote working and endpoint controls so staff are not given conflicting instructions. The step closes with a custody and transport standard and a sign-out record format that captures each asset's movement.
Configure device protection before issue
Before any device leaves the premises, confirm that it has full disk encryption, an automatic screen lock with a timeout set by policy, current operating system patches and endpoint security software. Where your mobile device management or endpoint platform supports remote wipe and remote lock, enable it and test it on a non-production device. Confirm the exact capabilities of each platform with its vendor, since support differs by operating system and product. The output is a configuration baseline for off-site devices and a build checklist signed for each device before issue.
Write the loss and theft reporting procedure
Document how a staff member reports a lost, stolen or compromised off-site asset, including a named contact role and a reporting channel that works outside office hours. Set the reporting deadline in your own policy, since the standard leaves that choice to the organization, and state it clearly to staff. The procedure should trigger containment steps such as remote lock or wipe, account revocation, a check of what data was on the device, and a decision on whether a privacy or contractual notification is needed. The step closes with a tested procedure, a contact list and an incident record template linked to your incident management process.
Train staff on off-site responsibilities
Deliver short training to everyone who receives an off-site asset, covering the approved classes, custody rules, screen and device protection, public Wi-Fi and shoulder surfing, and how to report a loss immediately. Ask staff to acknowledge the rules when they sign for equipment, and refresh the material when the policy changes. Keep records of attendance and acknowledgments, since an assessor will look for evidence that the rules were communicated. The output is a training record linked to each user and the signed acknowledgment stored with the asset sign-out.
Run periodic checks on off-site assets
Set a review cycle, decided by your risk owner, in which a sample of off-site assets is compared against the register and the sign-out records. Check that devices are still encrypted and patched, that sign-outs are current, that returns were recorded, and that any reported losses were handled under the procedure. Record exceptions, assign corrective actions and feed results into your management review and internal audit program. The step closes with a dated check report, documented corrective actions and an update to the register and the rules where gaps were found.

Evidence that passes an A.7.9 security of assets off-premises audit

An assessor testing A.7.9 follows an off-site asset from the register to the person holding it, then checks how it was protected and what happened when it was lost or returned. The cards below cover the documents and records that answer those questions, along with the routine checks that keep each one accurate between audits.

Off-site asset policy

This is the written rule set that tells staff which devices and media may leave the premises, who approves them, and what protection they must have before they go. An auditor compares the policy with practice, so it should name the asset classes covered, the minimum controls (encryption, screen locks, no unattended transport) and the owner who reviews it. Check that it links to the remote working and endpoint rules, and that the version and review date are recorded. Review it at least once a year and after any incident that exposed a gap.

Asset register with location and custodian

The register is the starting point for every off-site test. Each record should show the asset, its classification, its current location (for example, a home office or a named site) and the named custodian responsible for it. Reconcile the register against the device inventory on a regular schedule, such as monthly, and record the date and reviewer of each reconciliation. Entries that show an off-site location without a custodian are the first thing an assessor will question. In GLPI, the Assets module can hold these fields, and the GLPI Agent can feed inventory data into it.

Checkout and return records

Checkout records prove that an asset left the premises under a named person and a documented approval, and return records prove it came back or was accounted for. Keep the date, the custodian, the asset identifier, the condition at handover and the expected return date. Overdue checkouts should trigger follow-up, and the process should cover staff who leave the organization while still holding assets. An auditor will typically pick a sample of off-site assets and ask for these records, so confirm that every asset in the register can be traced to a checkout entry or a documented exception.

Encryption and endpoint configuration exports

Configuration exports show the protection actually applied to off-site devices, such as disk encryption status, screen lock timeout, patch level and whether monitoring agents are reporting. Wazuh Syscollector can gather hardware, operating system, installed software, open ports and Windows updates from each endpoint into its dashboard, which supports this evidence. Note that Nextcloud server-side encryption protects file contents on the server but does not encrypt file names or folder structure, so it should not be presented as proof that a laptop is protected. Export these reports on a schedule and keep dated copies.

Transport and travel approvals for sensitive media

Removable media and devices carrying sensitive information need a documented approval before they leave the premises, along with the transport method and the recipient. The approval should identify the classification of the data, the encryption applied, the route or courier, and the person accountable during transit. For international travel, many organizations add a further check on which devices may be carried. Confirm with your legal and security leads which destinations and data types need prior sign-off, and keep approvals linked to the matching checkout record.

Loss or theft reports with follow-up

When an off-site asset is lost or stolen, the record of what happened is often the most scrutinized item in an audit. A complete report captures the time and place of loss, the asset and data involved, whether the device was encrypted, who was notified, and the actions taken, such as remote wipe, credential revocation and any assessment of notification duties. Each report should close with a documented review that feeds back into the policy or training. Ask your team to confirm that reports are logged even when the loss turns out to be minor, because a missing report is harder to explain than a single incident.

Which self-hosted open-source tools produce A.7.9 evidence?

GLPI, licensed under GPL-3.0-or-later, supports the asset register that an auditor usually asks for first: which computers, peripherals and other equipment the organization owns, and who they are assigned to. Its Assets module covers computers, monitors, software, network equipment, peripherals, printers, phones and racks. Records can be entered manually or pushed automatically by the GLPI Agent through native inventory, which has been built into GLPI since version 10.

Register of portable equipment: Laptops and other devices can carry an assigned user and location, giving a baseline to compare against when a device is reported missing.
Automated inventory: The GLPI Agent can push hardware and software data, which reduces reliance on manual updates for devices that leave the premises.
Assignment history: Reassignments and status changes provide a trail for custody decisions.
Software records: Installed software entries help show which licensed programs sit on each device.

GLPI does not record where a device is at any moment, and it does not show whether a disk is encrypted or whether a loss was reported within a set time. Confirm device-level encryption and location tracking with your own mobile device management or endpoint tools, and check whether your asset records are updated when staff take equipment off-site.

What meeting A.7.9 costs in money and effort

This table breaks the cost of meeting A.7.9 into components, showing who is paid, whether each cost is one-time or recurring, and what pushes it up or down. No price or duration is stated because none has been researched; use the questions in the final row to compare written quotes. The main takeaway is that device count, travel patterns and the number of sites drive most of the effort.

Cost component	One-time or recurring	What drives it up or down
Asset register setup and reconciliation	One-time setup, recurring reconciliation	Number of laptops, phones and media in scope; how many sites and home offices hold assets; whether an existing inventory can be imported
Device protection and encryption standards	One-time configuration, recurring checks	Mix of operating systems; whether full-disk encryption and screen lock are enforced centrally or by hand; number of unmanaged personal devices
Licenses and tooling	Recurring where commercial, often none for open source	Self-hosted GLPI (GPL-3.0-or-later) and Wazuh (GPL-2.0-only) carry no license fee under their stated licenses, but hosting, storage and staff time still apply; commercial endpoint management adds per-device cost
Engineering time to integrate inventory	One-time, with recurring upkeep	Whether GLPI Agent and Wazuh Syscollector can be deployed to endpoints; number of directory and MDM integrations; quality of asset data at the start
Policy and procedure writing	One-time, reviewed periodically	Number of asset classes; whether the organization already has a mobile device or acceptable use policy to extend; approval steps needed
Staff training on custody and transport	One-time for onboarding, recurring for refreshers	Headcount; how often staff travel with devices; whether training is delivered live, recorded or folded into existing awareness programs
Loss-reporting process design	One-time design, recurring testing	Number of reporting channels; how quickly the security team must be told; links to incident management and breach notification duties
External review or readiness testing	One-time per assessment cycle	Scope of the review; whether an implementation partner prepares evidence and an independent auditor samples it separately; depth of testing
What to ask for in a quote	Applies before work starts	Written scope listing devices, sites and travel users; named deliverables such as inventory export, procedures and training materials; who maintains each item after handover; what is excluded

Who owns A.7.9 work, and what an implementation partner can take

Your organization owns the control itself. A.7.9 asks you to protect assets used or kept off-site from loss, damage, theft or compromise, and that accountability stays with you whatever help you buy. A named person on your side must decide which devices and media may leave the premises, who holds them, and how they come back.

Policy and scope: Write the off-premises asset rule, define which asset classes it covers (laptops, phones, removable media, printed records), and approve it through your ISMS governance.
Custody decisions: Decide who may take equipment home or on travel, which data may travel with it, and when encryption or remote wipe is required.
Loss and theft reporting: Set the reporting route, the time limit for reporting, and who investigates and notifies others, including any data protection duties that follow.
Records and reviews: Keep the asset register current, check that custody records match what is actually off-site, and review exceptions on a fixed schedule.

Before an audit, confirm that a named owner has signed the policy and that the loss reporting route has been rehearsed in a dry run.

Where A.7.9 controls usually fall short, and how to close each gap

Off-premises assets tend to fail audits in the same places: nobody records what leaves the building, nobody owns the media, and nobody hears about losses in time. Each card below names one gap an assessor is likely to test under A.7.9 and a closure step the organization can begin this month without waiting for a tool purchase.

Personal devices holding company data

Staff often read mail, store files or run admin consoles on personal laptops and phones that never appear in any asset register. An assessor who asks where company data lives off-site will find these devices quickly. Start by asking each team which personal or unmanaged devices touch company systems, then decide per device whether it is enrolled, restricted to web access, or banned from holding company data. Record the decision so the register reflects reality.

No owner for removable media

USB drives, external disks and backup tapes leave the office with no named custodian, so when one goes missing nobody can say what it held. A.7.9 expects the organization to know who is responsible for each asset while it is away from the premises. Assign one owner per item or per pool, record the classification of the data it may hold, and require a sign-out entry whenever media leaves the site. Review the list each quarter to catch unclaimed items.

Loss reports that reach nobody

Staff may know a laptop was lost but not whom to tell, or they wait until the next working day. Delayed reporting removes the chance to wipe the device, revoke tokens and assess whether personal data or contractual information was exposed. Publish one loss-reporting route that staff can use at any hour, name the on-call recipient, and run a short tabletop exercise to confirm the message arrives and triggers the same steps every time.

Register data months out of date

An asset register that was accurate at the last audit drifts quickly when devices are lent, reassigned or returned from travel. Assessors compare the register against what users actually hold, and gaps appear fast. Tie register updates to joining, leaving and device hand-over steps in the HR and IT workflows, and let an inventory agent report endpoints automatically where the platform allows it. Compare the two sources monthly and log every difference.

No encryption check on travel devices

A device taken on a trip is only as protected as its disk encryption and screen lock. Many organizations assume encryption is enabled and never check it, so a stolen laptop may expose everything on it. Before a device leaves, confirm that full-disk encryption is active, a screen lock is set, and remote wipe works. Keep the check result with the register entry so the evidence exists when an assessor asks for it.

Cloud files synced to devices unchecked

Files kept on self-hosted file platforms can be downloaded to laptops and carried off-site, where server-side protection no longer applies in the same way. The file platform's encryption protects content at rest on the server but does not hide file names or folder structure, so sensitive labels can still leak. Decide which classifications may sync to mobile devices, restrict sync clients accordingly, and confirm the setting in the platform's configuration before you rely on it.

What do buyers ask before bringing in help for A.7.9?

How much extra effort does A.7.9 add beyond an asset register?

A.7.9 adds the rules and records for assets that leave the premises, on top of knowing what assets exist. An asset register tells you that a laptop belongs to someone; A.7.9 asks what happens when that laptop goes home, travels, or is lost. The extra work usually falls into four areas: defining custody and transport rules, recording which off-site assets are out and who holds them, setting encryption and loss-reporting expectations, and keeping proof that staff follow them. The effort scales with how many people work remotely, how many devices and media travel, and how many sites are involved. Ask any partner to show how they will separate the register work from the off-premises rules so you can see the true increment.

Can a small team run A.7.9 without outside help?

Often yes, if the team has a clear owner, a short list of off-site asset types, and a habit of keeping records. A small team with a few laptops and a handful of staff who occasionally travel can usually write a concise rule set and check it quarterly. Difficulty rises when assets are shared, when contractors hold company equipment, or when no one owns the asset inventory. The control is about discipline rather than tooling, so the main risk for a small team is inconsistent recording. Outside help is most useful for drafting the rule set, testing whether the evidence would satisfy an auditor, and reviewing the gaps before a certification audit.

How long does the A.7.9 work usually take?

Timing depends on scope, and no fixed duration applies across organizations. The main drivers are the number of asset types that leave the premises, the state of the current asset register, how many teams and locations are involved, and whether endpoint management or inventory tools already exist. Organizations with a current register and managed laptops generally need less time to define the rules than those starting from spreadsheets. Ask any implementation partner for the timeline in the written scope, which should list the assets covered, the systems to configure, the evidence to produce, and the review points agreed with you before work starts.

What does the organization need to provide for the work?

The organization must own the decisions and the controls, while a partner helps prepare systems and evidence. You will need a named control owner, access to the current asset register, a list of roles that take equipment off-site, and the policies that cover acceptable use, encryption and incident reporting. Someone from IT, HR and facilities should be available to confirm how devices are issued, returned and disposed of. Technical access to endpoint management, inventory and logging systems is also needed so that evidence can be pulled from real records rather than reconstructed afterwards.

Can an implementation partner issue the A.7.9 evidence for certification?

No. An implementation partner can prepare the systems, records and evidence, but only an independent certification body issues an ISO 27001 certificate after its audit. The organization remains responsible for its controls, and the auditor decides whether the evidence supports conformity. DeployOpen prepares systems and evidence for compliance assessments and does not issue audit reports, attestations or certifications. Before engaging anyone, confirm that the partner has no role that could compromise the auditor's independence, and check the certification body's accreditation through the IAF CertSearch database referenced by ISO's certification page.

What does a fixed-scope A.7.9 engagement cover?

A fixed-scope engagement covers the deliverables and timeline agreed in writing before work starts. For A.7.9, a written scope typically states which asset types and user groups are included, which platforms will hold the register and loss records, which rules will be drafted or reviewed, what evidence will be produced, and what the organization must supply. It should also state what is excluded, such as the wider asset management program or the certification audit itself. DeployOpen does not publish a price list, so a quote follows from that written scope. Ask for the scope before comparing quotes, because differences in what is included often explain most of the price gap.

Which parts of the A.7.9 work can be ongoing and which are one-time?

The rule set and initial configuration are usually one-time work, while recording, reviews and support recur. Writing the custody, transport and loss-reporting rules, configuring inventory collection, and testing the first evidence trail are project tasks. Ongoing work includes keeping the register current as devices are issued and returned, reviewing loss reports, and checking that staff follow the rules during internal audits. Ongoing support, upgrades and continuous testing are available to DeployOpen clients as retainers, so ask whether recurring review should be priced separately from the initial scope.

How DeployOpen scopes and prepares A.7.9 evidence

DeployOpen works on A.7.9 Security of assets off-premises as part of a fixed-scope engagement that covers the systems and records behind your off-site device rules. We prepare the inventory, custody and loss-reporting evidence in your own environment, while your organization owns the control and an independent auditor decides whether it is met.

How we scope

Agree in writing which off-site device types, media and travel scenarios fall under A.7.9 for your organization.
Define which asset inventory sources, endpoint tools and records count as the evidence base for the control.
Confirm which parts remain with your policy owners, HR and legal, such as acceptable use terms and loss-reporting obligations.

How we build

Configure self-hosted inventory, such as GLPI Assets, to record devices assigned for off-site use and their custodians.
Deploy endpoint inventory agents, such as Wazuh Syscollector, to show installed software, encryption status and last check-in for remote devices.
Set up encrypted storage for files kept off-site, using server-side encryption in Nextcloud where it fits your data handling rules.

How we hand over

Deliver the configured tools, access settings and documented procedures for custody, transport and loss reporting.
Provide a written evidence map that links each A.7.9 expectation to the report, log or record that shows it operating.
Document limitations, including what encryption at rest does not cover, so your team and auditor see the gaps clearly.

How we support

Offer ongoing support, upgrades and continuous testing of the platforms as a retainer after handover.
Review inventory completeness and loss-reporting records with your team before each internal or external audit.
Confirm with your certification body which evidence format and sampling approach it expects for this control.