ISO 27001 A.7.9: Protect assets away from your premises

What A.7.9 requires in practice

Annex A control 7.9 asks the organisation to protect assets that are away from its premises. That includes laptops, phones, documents and other equipment carried by staff, items kept at a client site or a home, and assets in transit. The aim is to reduce loss, damage and compromise without stopping the work the asset enables. The parts to consider are the purpose and owner of each off-site use, the information the asset holds, how custody is maintained during transport, temporary storage and use, and what happens on loss or return. Privately owned devices used for business purposes are within its reach where such use is permitted. The outputs are authorisation arrangements that suit the role, practical handling guidance, and a clear route for reporting loss. The standard does not require every protective technology for every journey.

Decide what may leave and why

Identify the business purpose, responsible person and information involved. A laptop configured for general office work may contain more information than a short field assignment needs. Consider whether the task can use a restricted dataset, controlled remote access or a device prepared for the specific activity. Reducing unnecessary information can reduce the consequences of loss.

Authorisation should be understandable and proportionate. It may be built into a role or assignment rather than require a new signature for every routine journey. Exceptions need a clear route. Include privately owned devices used for organisational work where permitted; ownership alone does not decide whether business information needs protection.

Follow custody through the whole journey

Consider transport, temporary storage, use and return. A journey can involve a vehicle, hotel, client location and another employee, each with different exposure. People need practical instructions for keeping control of the asset, protecting information from observation and reporting loss or suspected interference promptly.

When custody changes, establish who receives responsibility and what is transferred. Confirm whether information should be removed before another user receives the device, and preserve required business records appropriately. A courier collection receipt may show that a parcel changed hands without establishing which asset or sensitive content was inside.

Why protecting assets away from premises matters to the business

Assets leave the building every day in bags, vehicles and homes, and that is where theft, loss and casual exposure happen. A lost laptop or misplaced file can lead to notification duties, customer complaints and reputational damage far out of proportion to the equipment's value. Organisations that reduce what travels, and prepare people for the journey, cut both the likelihood and the consequences. Customers whose data is carried by your staff expect this to be thought through. For audit, off-site arrangements are tested by asking staff how they would protect and report a lost device, so practical, understood arrangements make findings less likely.

How to implement A.7.9

Match the protection to the journey and the information, not to a blanket rule. Keep the arrangements proportionate so that staff are not tempted to work around them. Involve the people who travel most often when drafting the guidance, since they know where the practical difficulties are.

1. Identify who takes which assets off-site, for what purposes and how often.
2. Consider limiting the information carried, for example by using a restricted dataset or controlled remote access for a specific task.
3. Set authorisation arrangements built into roles or assignments, with an exception route for unusual cases.
4. Describe custody through the whole journey, covering vehicles, hotels, client sites and handover to colleagues.
5. Give people practical guidance on keeping control of devices and shielding information from observation.
6. Define how loss or theft is reported, and how quickly the organisation can respond to it.
7. Cover privately owned devices where use is allowed, agreeing the conditions with legal and HR input.

Illustrative construction example: a shared survey tablet

Illustrative software example: a client demonstration abroad

A fictional software company sends a developer to demonstrate a product at a client's office. The developer initially intends to use a daily work laptop containing unrelated customer material and development credentials. The demonstration itself needs only a prepared environment and sample information.

The company authorises a suitable demonstration setup, removes unnecessary access and agrees how the device will be handled during the visit and return. The employee knows whom to contact if the device is lost or unexpectedly inspected or retained. Before departure, a check confirms the prepared content and access. After return, the organisation reviews any reported concerns and restores the normal arrangement through its approved process.

Combine physical and technical protection

Technical measures can reduce exposure, but their limits matter. Encryption does not prevent loss of the equipment or every disclosure from an unlocked session. Remote deletion depends on conditions such as connectivity and device state and should not be treated as certain recovery of control. Select measures using the asset, information and actual working situation.

Equipment permanently installed at an external location also needs attention. Agree who controls access, inspects its condition and reports damage or changes. A device installed at a customer site can be physically remote while still supporting the organisation's service. The arrangement should explain the retained responsibilities rather than assuming the customer's premises transfer them automatically.

Evidence and useful checks

Common nonconformities with A.7.9

Typical findings show assets travelling without thought. They typically reflect arrangements written for the office and never adapted for staff who spend most of their time elsewhere.

• Laptops carrying far more information than the field task requires.
• No record of which equipment is held away from the premises or by whom.
• Staff unsure how to report a lost or stolen device.
• Equipment left unattended in vehicles or hotel rooms with no guidance.
• Personal devices used for client work with no agreed conditions.