All 93 controls · Physical controls
Control 7.9
Security of assets off-premises
What ISO/IEC 27002:2022 control 7.9 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Assets taken or located off-site are to be protected. Purpose: stop devices used away from the premises from being lost, stolen, damaged or compromised, and avoid the operational disruption that would cause. Guidance: any device used outside the premises that stores or processes information, whether owned by the organization or privately owned and used for its work (BYOD), needs protection, and its use is authorized by management. For such devices consider: never leaving equipment or media unattended in public or insecure places; following manufacturers' protection instructions, for example against strong electromagnetic fields, water, heat, humidity and dust; keeping a chain-of-custody log naming the people and organizations responsible when off-site equipment passes between parties, and securely deleting information that need not travel with it; requiring authorization, where needed and practical, for removing equipment and media from the premises and recording removals as an audit trail (5.14); guarding against others viewing screens on public transport and against shoulder surfing; and location tracking with remote wipe. Equipment permanently installed off-site, such as antennas or cash machines, faces higher and location-dependent risk of damage, theft or eavesdropping, so consider physical security monitoring (7.4), protection against physical and environmental threats (7.5), physical access and tamper-proofing controls, and logical access controls. Other information: 8.1 and 6.7 cover further aspects of endpoint and remote equipment protection.
Purpose in the standard’s terms, in our words: Keeps devices used away from the premises from being lost, stolen, damaged or compromised.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Physical security, Asset management; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | Physical securityAsset management |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- Management authorization records for use of organization-owned and BYOD devices off-site
- Removal authorization and audit trail for equipment and media leaving the premises
- Chain-of-custody logs for off-site equipment passed between people or organizations, with records of data deleted before transfer
- Device management configuration showing location tracking and remote wipe capability
- Guidance to personnel on not leaving equipment unattended, manufacturer protection instructions and shoulder surfing
- Physical and logical protection records for permanently installed off-site equipment such as tamper seals and monitoring
Where audits commonly find gaps
- BYOD devices are used for work without management authorization or any control
- No record exists of which equipment is off-site or with whom
- Remote wipe is not enabled, so a lost laptop cannot be neutralized
- Unattended off-site equipment such as kiosks lacks tamper detection
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (11.2.6) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.