Key takeaways
- Protect devices and information taken outside the office.
- Laptops and phones carry information everywhere.
- Start here: encrypt all portable devices.
Purpose
Protect devices and information taken outside the office.
Requirement
Requirement summaryOff-site assets shall be protected.
Why it matters
Laptops and phones carry information everywhere. They need protection when they leave the office.
How to implement
- Encrypt all portable devices.
- Use device management to enforce locks and remote wipe.
- Advise staff on travel and public-place risks.
- Record devices taken off-site where relevant.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 7.9. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your rules for equipment used outside the office (for example laptops and phones).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.7.9 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list of devices used off-site showing they are encrypted and can be located or wiped.
- Records of lost or stolen devices and what was done.
- Proof staff have accepted the rules for travelling with equipment.
Things you should be able to show or explain
- Staff should be able to explain how they protect devices when travelling.
How much to show: A handful of devices.
Common mistakes
- Unencrypted laptops.
- Lost devices not reported.
- Laptops left in cars.
- No remote wipe capability.
- Tip: Full-disk encryption on all laptops.
Policies & documents to have
- Asset Management Policy
- Information Security Policy
FAQ
Is A.7.9 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.7.9?
Be ready to explain how the control works in your organisation and to provide things like: Your rules for equipment used outside the office (for example laptops and phones)…