ISO/IEC 27001:2022 Annex A · Control 5.11

Return of Assets: A Practical Implementation Guide

Recover organizational assets and information promptly when employment, contracts or roles end.

This control ensures that personnel and external parties return organizational assets in their possession when their engagement changes or ends.

Practical interpretation: Asset return includes more than laptops. It covers badges, keys, tokens, documents, removable media, intellectual property and organizational information stored in approved or exceptional locations.

What should the control achieve?

Issued assets are traceable to recipients.
Return obligations are communicated in advance.
Offboarding coordinates physical and digital recovery.
Missing assets and retained information are risk assessed.

Step-by-step implementation

Maintain assignment records

Link issued assets to a person, owner, serial number and location.

Define contractual duties

Include return, deletion and cooperation requirements in employment and supplier terms.

Trigger coordinated offboarding

Managers notify HR, IT, Facilities and Security with sufficient notice.

Collect and verify

Check condition, accessories, data transfer and return of keys, badges and tokens.

Address remote and high-risk cases

Provide secure shipping, rapid disabling and escalation for non-return.

Close evidence

Reconcile the asset register and retain confirmation.

What this could look like in practice

A remote employee receives a prepaid tracked return package. IT verifies the laptop serial number, preserves required business files, securely wipes the device before reuse and closes the asset assignment. Facilities disables the badge and HR records completion.

Activity	Practical implementation	Evidence
Employee exit	Manager initiates checklist before final day.	Offboarding ticket
Remote return	Tracked shipping and receipt confirmation are used.	Courier and receipt record
Supplier end	Service owner confirms equipment, media and documents returned or destroyed.	Supplier closure certificate

Implementation evidence

Asset assignment register
Return clauses
Offboarding checklist
Courier records
Receipt confirmation
Missing-asset escalation
Wipe or reuse record
Closed inventory assignment

Useful metrics

Assets returned by due date
Average return time
Unresolved missing assets
Inventory records closed accurately

Common mistakes

Tracking only expensive hardware.
Starting the process on the final day.
Forgetting remote workers and suppliers.
Reissuing equipment before secure handling.
Closing HR offboarding while assets remain unresolved.

Questions an auditor may ask

How do you know which assets a leaver holds?
Show a completed remote return.
What happens if an asset is not returned?
How is returned information preserved or erased?

Implementation test: Select a recent leaver and reconcile every assigned asset, badge, token and information obligation to closure evidence.

Continue through Annex A

Explore the growing library of practical guides for all 93 Annex A controls.

Open the ISO 27001 Annex A Control Library

This independent educational guide paraphrases the practical intent of the control and does not replace the official ISO standards, professional advice or an organization-specific risk assessment. It is not affiliated with or endorsed by ISO.

ISO 27001 Annex A 5.11: Return of Assets – Practical Implementation Guide