Key takeaways
- Get company assets back when someone leaves or changes role.
- Leavers and changing contracts are a common source of data leaks.
- Start here: record which assets are issued to each person or supplier.
Purpose
Get company assets back when someone leaves or changes role.
Requirement
Requirement summaryPersonnel and other interested parties as appropriate shall return all the organization’s assets in their possession upon change or termination of their employment, contract or agreement.
Why it matters
Leavers and changing contracts are a common source of data leaks. Getting assets back closes that gap.
How to implement
- Record which assets are issued to each person or supplier.
- Add asset return to your offboarding checklist.
- Wipe or reassign returned devices and record the outcome.
- Chase and escalate unreturned items.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.11. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your leaver checklist, including returning equipment and access cards.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.11 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list of people who left in the last 12 months, with proof their equipment was returned.
- Follow-up records for anything not returned, such as remotely locking a laptop.
Things you should be able to show or explain
- Be able to explain who checks that items are returned and how.
How much to show: A handful of recent leavers.
Common mistakes
- No record of equipment being returned.
- Leavers' laptops still listed as in use.
- Data on personal devices forgotten at exit.
- No record of what was issued in the first place.
- Tip: Link asset return to your leaver checklist.
Policies & documents to have
- Asset Management Policy
- Human Resource Security Policy
- Information Security Policy
FAQ
Is A.5.11 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.11?
Be ready to explain how the control works in your organisation and to provide things like: Your leaver checklist, including returning equipment and access cards…