Return of assets

What the control asks

When their employment, contract or agreement changes or ends, staff and, where relevant, other interested parties are to hand back every organizational asset they hold. Purpose: protect the organization's assets during the change or termination process. Guidance: the change or exit process should formally include recovery of all physical and electronic assets issued to the person, whether the organization owns them or holds them in trust. Where people buy organizational equipment or used their own devices, procedures should make sure relevant information is traced, moved to the organization and securely wiped from the device (7.14). Knowledge held by the person that matters for ongoing operations should be documented and handed over. During the notice period and afterwards the organization should stop people who are leaving from copying relevant information, such as intellectual property, without authorization. The assets to be returned should be identified and documented, and can include user endpoint devices, portable storage, specialist equipment, authentication hardware for systems, sites and archives (keys, tokens, smartcards) and paper copies of information. Other information: information on assets the organization does not own is hard to recover, so its use should be limited through other measures, for instance managing access rights (5.18) or cryptography (8.24).

Purpose in the standard’s terms, in our words: Protects organizational assets when employment, contracts or agreements change or end.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Asset management; Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• The leaver and mover procedure with an asset return step and a checklist of assets issued to each person
• Signed asset return records reconciled against the asset inventory
• Records of information transferred from and securely wiped on personally owned or purchased devices
• Knowledge transfer or handover documentation for departing staff holding operationally important knowledge
• Evidence of monitoring or technical restrictions on copying data during notice periods
• Return records for authentication hardware such as keys, tokens and smartcards

Where audits commonly find gaps

• Asset return is not reconciled against what was issued, so missing items go unnoticed
• BYOD devices of leavers still hold organizational data
• Nothing prevents bulk downloads by staff under notice
• Contractors and third-party staff are excluded from the return process

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (08.1.4) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.10 Acceptable use of information and other associated assets
• 5.14 Information transfer
• 5.37 Documented operating procedures

Read the five attributes All 93 controls