ISO 27001:2022 · Physical controls
ISO 27001:2022 7.9: Security of assets off-premises
ISO 27001:2022 7.9 covers Security of assets off-premises. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.7.9, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is BYOD devices are used for work without management authorization or any control.
Assets taken or located off-site are to be protected. Purpose (stated in ISO/IEC 27002:2022): keeps devices used away from the premises from being lost, stolen, damaged or compromised. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 7.9.
What evidence supports 7.9?
- Annex A physical controlStatement of Applicability entry for control A.7.9, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A physical controlManagement authorization records for use of organization-owned and BYOD devices off-site
- Annex A physical controlRemoval authorization and audit trail for equipment and media leaving the premises
- Annex A physical controlChain-of-custody logs for off-site equipment passed between people or organizations, with records of data deleted before transfer
- Annex A physical controlDevice management configuration showing location tracking and remote wipe capability
Where this requirement comes from
This is our own statement of ISO 27001:2022 7.9, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- BYOD devices are used for work without management authorization or any control
- No record exists of which equipment is off-site or with whom
- Remote wipe is not enabled, so a lost laptop cannot be neutralized
- Unattended off-site equipment such as kiosks lacks tamper detection
How it maps to SOC 2
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.