ISO 27001:2022 Annex A 5.11 – Return of Assets

What Is The Purpose of Annex A 5.11?

The following are examples of information assets for an organisation:

• Physical documents.
• Digital files and databases.
• Software programs.
• Even intangible items like trade secrets and intellectual property.

A company’s information assets can be valuable in many ways. This includes containing sensitive information about its customers, employees, or other stakeholders that bad actors can exploit for financial gain or identity theft. In addition to financial, research and operational information, they could provide your competitors with a competitive advantage if they were able to gain access to it.

For this reason, all assets and assets of employees and contractors who terminate their employment with an organisation must be returned.

As part of the exit process, assets need to be returned according to the process unless otherwise agreed upon and documented:

• Annex A.5 outlines the steps to be taken if the non-return is recorded as a security incident.
• To ensure continued protection, periodic asset audits are also necessary to ensure the return of assets procedure is foolproof.

Change of Employment Status per ISO 27001:2022 Annex a 5.11

As part of changing or terminating employment, contracts, or agreements, control 5.11 protects the organisation’s assets. Unauthorised individuals are prohibited from retaining organisation assets (including equipment, information, software, etc.) under this Annex A control.

You must ensure your employees and contractors don’t take sensitive data by identifying potential threats and monitoring the user’s activity before they leave.

When an individual is terminated, this Annex A control prevents them from accessing IT systems and networks. A formal termination process should be established by organisations so that individuals can no longer access any IT systems. You can achieve this by revoking all permissions, disabling accounts, and removing access to building premises.

It is necessary to establish procedures to ensure that all employees, contractors, and other relevant parties return all assets no longer needed for business purposes. These assets should be replaced as soon as possible.

Also, organisations should check the individual’s work area to ensure that all sensitive information has been returned.

Consider, for instance:

• The organisation’s equipment (laptops and removable media) is collected upon separation.
• Upon contract completion, contractors are required to return all equipment and information.

Building an Exit Process and What You Need to Do

An organisation must formalise its change or termination process, which includes returning all previously issued physical and electronic assets owned or entrusted to it.

Any access rights, accounts, digital certificates, and passwords should also be removed as part of the process. This formalisation is especially critical when a change or termination occurs unexpectedly, like death or resignation. Unauthorised access to organisation assets can lead to a data breach if not prevented.

A secure disposal/return process should ensure that all assets are accounted for.

ISO 27001:2022 requires the organisation to identify and document all information and associated assets to be returned, including:

1. User endpoint devices.
2. Portable storage devices.
3. Specialist equipment.
4. Authentication hardware (e.g. mechanical keys, physical tokens and smartcards) for information systems, sites and physical archives.
5. Physical copies of information.

After termination, the user should complete a formal checklist containing all the items that need to be returned or disposed of. This checklist should include any required signatures to confirm that the assets have been properly returned or disposed of.

What Are the Changes and Differences From ISO 27001:2013?

ISO 27001:2013 was updated in October 2022 to ISO 27001:2022.

Annex A Control 5.11 is not new but a modification of Annex A control 8.1.4 – the return of assets.

In the implementation guidelines, Annex A controls are essentially the same, with similar language and phraseology. However, ISO 27001:2022’s Annex A control 5.11 has an attributes table that lets users match it to what they are implementing. Control 5.11 in ISO 27001:2022 specifies which assets can be returned at the end of employment or contract termination.

Examples of these include:

• User endpoint devices.
• Portable storage devices.
• Specialist equipment.
• Authentication hardware (e.g. mechanical keys, physical tokens and smartcards) for information systems, sites and physical archives.
• Physical copies of information.

In the ISO 27001:2013 version, this list is not available.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How Do These Changes Affect You?

ISO 27001:2022 is an update to the 2013 standard. The committee that oversees the standard did not make any significant changes.

How ISMS.online Help

You can implement and manage an ISO 27001/ 27001 Information Security Management System with ISMS.online, regardless of your experience with the standard.

The perfect fusion of knowledge and technology for early ISO 27001 success. ISMS.online includes a policy and tool for asset management.

With our system, you’ll be guided step-by-step through setting up an ISMS and managing it:

• ISMS.online provides a step-by-step guide to implementing ISO 27001/27002 in any organisation.
• A risk assessment tool that guides you through the risk identification and assessment process.
• We offer a policy pack that can be customised to suit your needs online.
• Managing documents and records as part of your ISMS is easier with a document control system.
• Better decision-making through automatic reporting.
• With our cloud-based platform, you’ll be able to document proof of compliance with the ISO 27001 framework with a checklist of your processes.

Get in touch today to book a demo.