[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-7-9":3},{"item":4,"lessons":16,"controls":22,"related":35},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-7-9","Annex A 7.9","Security of assets off-premises",1,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Assets used outside the organisation's premises should be protected. This covers laptops, phones and other equipment taken home or travelling, as well as equipment permanently located elsewhere.\n\n**In practice.** Off site devices are registered, encrypted, protected by screen lock and remote wipe capability, and covered by endpoint protection. Staff receive guidance on keeping devices with them while travelling, avoiding unattended vehicles and working discreetly in public places. Equipment installed at third party sites, such as kiosks or network devices, has its physical risks assessed. Evidence includes device management reports, encryption status, the guidance given to staff and records of lost or stolen device handling.\n\n**Common gaps.** Organisations often know which devices are encrypted but not which ones have stopped reporting in. Equipment at customer or partner sites and personal devices used for work are frequently missing from the asset inventory.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"stolen-unencrypted-laptop-triggers-gdpr-fines-for-controller-and-processor","Stolen Unencrypted Laptop Triggers GDPR Fines for Controller and Processor","2026-07-30T14:20:23.867+00:00",[23,27,31],{"slug":24,"name":25,"problem":26,"stories":9},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":28,"name":29,"problem":30,"stories":9},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":32,"name":33,"problem":34,"stories":9},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[36,41,45,50,54,58,62,66],{"family":37,"item":38,"code":39,"title":40,"together":9},"cis","10","Control 10","Malware Defenses",{"family":37,"item":42,"code":43,"title":44,"together":9},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":46,"item":47,"code":48,"title":49,"together":9},"gdpr","24","Article 24","Responsibility of the controller",{"family":46,"item":51,"code":52,"title":53,"together":9},"25","Article 25","Data protection by design and by default",{"family":46,"item":55,"code":56,"title":57,"together":9},"28","Article 28","Processor",{"family":46,"item":59,"code":60,"title":61,"together":9},"32","Article 32","Security of processing",{"family":46,"item":63,"code":64,"title":65,"together":9},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":5,"item":67,"code":68,"title":69,"together":9},"a-8-1","Annex A 8.1","ISO\u002FIEC 27001:2022 Annex A 8.1: User endpoint devices"]