Ensuring the Secure Return of Organisational Assets
Properly managing organisational assets during employment, contracts, or agreements is essential to maintaining information security. This is where ISO 27001 control 5.11 comes in – Return of Assets.
Ensuring that all assets are returned during role transitions, such as employment termination or contract completion, helps safeguard organisational resources and mitigates risks of unauthorised access or data breaches.
Table of Contents
The Importance of Returning Organisational Assets
The primary purpose of a robust asset return process is to:
- Protect sensitive organisational information and resources.
- Maintain control over physical and electronic assets.
- Ensure compliance with organisational policies and security standards.
Key Steps in the Asset Return Process
A formalised approach to asset return ensures consistency and security. Here are the critical components:
1. Establishing Clear Procedures
- Define and document formal procedures for returning all organisational assets.
- Apply these procedures consistently across departments and roles.
2. Managing Personal and Organisational Equipment
- For organisational equipment used by personnel:
- Ensure all relevant data is securely transferred to the organisation.
- Verify that sensitive information is securely deleted from personal devices (refer to Section 7.14).
3. Capturing Critical Knowledge
- Document and transfer essential operational knowledge from departing personnel to ensure business continuity.
- Implement secure processes to safeguard intellectual property.
4. Preventing Unauthorised Access
- During notice periods, apply controls to prevent unauthorised duplication or transfer of sensitive information, including intellectual property.
Assets to Be Returned
The organisation should maintain a clear inventory of assets to be returned, which may include:
- User Endpoint Devices: Such as laptops, desktops, smartphones, and tablets.
- Portable Storage Devices: Including USB drives, external hard drives, and SD cards.
- Specialist Equipment: Such as industry-specific tools and hardware.
- Authentication Hardware: Keys, tokens, smartcards, and other access control devices.
- Physical Information: Paper files, printed documents, and archived materials.
Addressing Challenges and Mitigating Risks
1. Handling Data on Personal Devices
- For data stored on non-organisational devices:
- Restrict access using rights management systems (refer to Section 5.18).
- Employ cryptographic measures to secure sensitive information (refer to Section 8.24).
2. Ensuring Secure Data Transfers
- Develop clear protocols for securely transferring critical data to organisational systems.
- Use reliable and secure methods to erase data from non-organisational devices post-transfer.
Best Practices for Asset Management During Transitions
To streamline asset return processes and enhance security, organisations should:
- Maintain an Asset Inventory: Keep detailed, up-to-date records of all assigned assets.
- Educate Employees: Train staff and contractors on their responsibilities regarding asset return.
- Conduct Regular Audits: Monitor the effectiveness of asset return processes and identify areas for improvement.
- Communicate Clearly: Provide departing personnel with a detailed checklist of items to return, along with defined timelines.
FAQs
What is the aim of Control 5.11 in ISO 27001?
The goal is to ensure that all assets provided to employees, contractors, or third parties (like laptops, ID badges, mobile devices, or data) are returned when they leave the organisation or change roles. This prevents unauthorised access or data loss.
What counts as an “asset” under this control?
Assets include both:
– Physical items: laptops, access cards, USB drives, phones
– Information assets: confidential documents, intellectual property, client data
– Also includes software licenses and user accounts that must be deactivated
When should the return of assets process be triggered?
Asset return should be part of:
– Offboarding procedures (employee exits)
– Role or department changes
– Contractor or supplier disengagements
It should be tracked and documented to ensure nothing is missed.
How do we ensure all assets are returned properly?
Implement a return checklist during offboarding that:
– Lists all assigned assets
– Requires formal sign-off when items are returned
– Includes steps to revoke access rights and recover data from devices
Why is this control important for security and compliance?
Failing to recover assets can lead to:
– Unauthorised access to systems or data
– Data breaches if devices are lost or misused
– Non-compliance with GDPR or contractual requirements
It also helps maintain asset inventory accuracy.
Conclusion
Implementing a well-structured and consistent asset return process is key to protecting organisational resources during transitions. With ISO 27001 control 5.11, by formalising procedures, maintaining comprehensive records, and applying robust security controls, organisations can mitigate risks and ensure the integrity of their operations.
