ISO/IEC 27001 · Annex A 5.11

Return of assets

International Organization for Standardization (ISO) and IEC

Explanation

What it asks for. When employment, a contract or an agreement ends or changes, people and external parties should hand back all organisational assets they hold.

In practice. Leavers and role changers go through a defined offboarding checklist triggered from HR or procurement, covering laptops, phones, tokens, badges, keys and paper records. The checklist is reconciled against the asset inventory so missing items are visible and chased. Where personal devices hold company data, the organisation removes or wipes its data, for example through mobile device management, and records that it did. Evidence is a completed offboarding record for a sample of leavers, matched to inventory updates and access removal dates.

Common gaps. Contractors and third parties often fall outside the HR-driven process, so their equipment and data are never recovered. Knowledge and data held in personal cloud accounts or on unmanaged devices is rarely addressed, and inventories are too inaccurate to show what should come back.