What it asks for. Assets used outside the organisation's premises should be protected. This covers laptops, phones and other equipment taken home or travelling, as well as equipment permanently located elsewhere.
In practice. Off site devices are registered, encrypted, protected by screen lock and remote wipe capability, and covered by endpoint protection. Staff receive guidance on keeping devices with them while travelling, avoiding unattended vehicles and working discreetly in public places. Equipment installed at third party sites, such as kiosks or network devices, has its physical risks assessed. Evidence includes device management reports, encryption status, the guidance given to staff and records of lost or stolen device handling.
Common gaps. Organisations often know which devices are encrypted but not which ones have stopped reporting in. Equipment at customer or partner sites and personal devices used for work are frequently missing from the asset inventory.