Return of assets
Purpose
Protect the organisation's assets when employment, contracts or agreements change or end.
How to meet this control
In short: Ensure personnel return all assets on termination or change of role.
- Step 01Add asset return to the offboarding checklist with itemised sign-off for laptops, phones, tokens, keys, cards and any physical records
- Step 02Trigger offboarding automatically from the HR leaver event so IT, facilities and the manager act in step
- Step 03For BYOD, run a controlled wipe of organisational data and confirm removal in writing before the person departs
- Step 04Capture critical operational knowledge through handover documentation before the last working day
- Step 05Disable accounts and revoke access on or before the departure date and reconcile against the asset register
Tip: Add asset return to your offboarding checklist with sign-off.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Formalise the change or termination process to include return of all issued assets
- ›Clearly identify and document which assets must be returned, such as devices and storage media
- ›Where staff use their own equipment, securely transfer and wipe organisational information from it
- ›Capture and transfer knowledge important to operations before the person leaves
- ›Prevent unauthorised copying of information by people serving notice of termination
- ›Restrict access using other controls when information sits on assets the organisation does not own
- ›Include physical copies, authentication hardware and specialist equipment in the return list
Audit evidence to keep
- - Offboarding checklist showing itemised asset return with sign-off
- - Records linking leaver HR events to access revocation and asset recovery
- - Evidence of remote wipe or data removal for BYOD or personal devices
- - Knowledge handover documentation for departing staff in key roles
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.5.11. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.