ISO 27001 A.7.9: Security of Assets Off-Premises

Quick Reference (60 Seconds)

Bottom Line: When equipment leaves your premises, it leaves your controlled security environment. Whether it is a laptop for remote work, a server for maintenance, or a backup tape for off-site storage, off-site equipment requires explicit authorization, protection, and tracking.

What the Standard Actually Requires

Figure · Process

What A.7.9 asks you to do

ISO 27001:2022 Annex A.7.9 states:

ISO 27001:2022 Annex A 7.9 asks organizations to protect assets that are used or stored off-site.

ISO 27002:2022 expands this into practical guidance covering:

1. Authorization, Equipment must be formally authorized before being taken off-site
2. Risk assessment, Risks associated with taking equipment off-site must be assessed and treated
3. Protection during transport, Equipment must be protected from damage, theft, and environmental risks during transport
4. Security at destination, Equipment must be used in secure environments at the off-site location
5. Tracking and monitoring, Off-site equipment must be tracked and accounted for
6. Return procedures, Equipment must be verified for security and integrity upon return
7. Insurance, Equipment taken off-site must be appropriately insured

Why Equipment Off-Site Matters

The Extended Perimeter

Your organization's physical security perimeter ends at the building boundary. When equipment crosses that boundary, it enters an uncontrolled environment, public transport, hotel rooms, client offices, home offices, coffee shops, and vehicles. Each of these environments presents risks that do not exist within your controlled premises.

Key Statistics

• Laptop theft is one of the top causes of data breaches, accounting for 15–20% of reported incidents
• 43% of data breaches involve lost or stolen laptops, mobile devices, and backup media
• Off-site equipment is 3–5 times more likely to be lost or stolen than on-site equipment
• Unencrypted laptops that are lost or stolen result in a data breach 100% of the time (the data is immediately accessible)
• India's DPDP Act 2023 imposes penalties up to for data breaches from lost or stolen equipment

Real-World Consequences

• A laptop stolen from a car in a Bengaluru parking lot contained the entire customer database of a fintech startup; the laptop was unencrypted; the startup faced DPDP Act investigation and lost 40% of its customers
• A backup tape lost in transit between a bank's Mumbai headquarters and its disaster recovery site in Pune was never recovered; the tape contained unencrypted transaction data for 2 million customers; RBI imposed a penalty of
• A server sent off-site for repair was returned with the same hard drive but a different motherboard; the repair vendor had cloned the drive without authorization; customer data was leaked
• A company laptop left in a hotel room in Delhi was stolen; the laptop had auto-login enabled and contained VPN credentials, allowing the thief to access the corporate network
• An employee took a company tablet home for personal use; the tablet was dropped and the screen shattered; the employee took it to a local repair shop where the technician extracted all work emails and documents

Regulatory and Business Drivers

• DPDP Act 2023 requires protection of personal data on all devices, including off-site equipment
• RBI Cyber Security Framework mandates encryption for all devices containing customer data that leave the premises
• SEBI Cybersecurity Circular requires tracking and authorization for all equipment taken off-site from trading facilities
• PCI DSS v4.0 Requirement 9.5 requires physical security of devices that store or process cardholder data, including off-site
• SOC 2 CC6.1 requires logical and physical access controls for all devices, regardless of location

Scope and Applicability

What Is Covered

• All laptops and notebooks taken off-site for work, travel, or remote work
• All mobile devices (smartphones, tablets) used for work outside the office
• All backup media and storage devices transported to off-site locations
• All servers and equipment sent off-site for repair, maintenance, or relocation
• All portable IT equipment (projectors, demo kits, testing equipment) taken to client sites or events
• All equipment taken home by employees (even temporarily)
• All equipment taken to branch offices, disaster recovery sites, or data centers

What Is Not Covered

• Permanent equipment at remote offices or branch locations (covered by A.7.1, A.7.8, A.7.11)
• Personal devices not used for work (though BYOD policies may extend coverage)
• Equipment permanently installed at client sites (covered by contractual security requirements)

Applicability by Organization Type

Key Definitions and Terminology

Relationship to Other Controls

Implementation Roadmap (Week-by-Week)

Week 1: Equipment Inventory and Risk Assessment

• Inventory all equipment that may be taken off-site
• Identify equipment types, sensitivity levels, and typical off-site scenarios
• Assess current off-site practices and identify gaps
• Identify all off-site locations (home offices, client sites, branch offices, travel destinations)
• Assess transport risks (theft, damage, environmental, loss)
• Assess destination risks (unsecured networks, public spaces, shared facilities)
• Document current state and risks

Week 2: Policy and Procedure Development

• Draft equipment off-site policy
• Define authorization requirements for different equipment types and scenarios
• Define security requirements for off-site equipment (encryption, authentication, tracking)
• Create transport protection procedures (cases, locks, tamper seals)
• Create destination security requirements (secure networks, no public Wi-Fi, screen privacy)
• Define return verification procedures
• Create lost/stolen equipment response procedures

Week 3: Technical Controls Implementation

• Deploy full-disk encryption (FDE) on all laptops and mobile devices
• Deploy Mobile Device Management (MDM) for all off-site devices
• Configure remote wipe capability for all off-site devices
• Implement geofencing or location tracking for high-sensitivity devices
• Deploy VPN requirements for off-site network access
• Implement screen lock policies for off-site devices (shorter timeouts)
• Configure device tracking and find-my-device features

Week 4: Authorization and Tracking System

• Implement off-site equipment authorization process (form, workflow, approval)
• Create off-site equipment register with tracking
• Define authorization levels (manager, IT Security, CISO for high-sensitivity)
• Set up automated reminders for overdue returns
• Create equipment checkout/check-in system
• Implement asset tagging for all off-site equipment

Week 5: Transport and Destination Protection

• Procure secure transport cases for sensitive equipment
• Define packing and transport standards
• Vet and authorize courier services for equipment transport
• Create destination security guidelines for employees
• Define requirements for using equipment in public spaces (cafes, airports, hotels)
• Create hotel room security guidelines for traveling employees

Week 6: Training and Awareness

• Develop off-site equipment security training for all employees
• Create quick reference cards for off-site security
• Train managers on authorization procedures and responsibilities
• Train IT staff on MDM, remote wipe, and tracking tools
• Create awareness materials on the risks of off-site equipment
• Conduct simulated lost device response drill

Week 7: Lost/Stolen Equipment Response

• Document lost/stolen equipment response procedures
• Test remote wipe capability on sample devices
• Define notification requirements (IT Security, management, HR, legal)
• Create breach assessment procedures for lost/stolen devices
• Define insurance claim procedures
• Create post-incident review procedures

Week 8: Audit and Validation

• Conduct internal audit of off-site equipment controls
• Verify all off-site equipment is encrypted and enrolled in MDM
• Verify authorization records are complete and current
• Test remote wipe on a sample device
• Verify return verification procedures are followed
• Prepare documentation for external audit
• Plan for continuous improvement

Detailed Implementation Guidance

Equipment Authorization Levels

Authorization by Sensitivity:

Authorization by Scenario:

Security Requirements for Off-Site Equipment

Mandatory for All Off-Site Laptops and Mobile Devices:

Additional for High-Sensitivity Equipment:

Transport Protection

Personal Transport (Employee carrying equipment):

Courier/Logistics Transport:

Destination Security

Home Office Security:

Public Space Security (Cafes, Airports, Hotels, Trains):

Client Site Security:

Return Verification

Return Checklist:

Extended Absence Return:

• If equipment was off-site for more than 30 days, perform complete security review
• If equipment was in a high-risk location, perform enhanced verification
• If equipment was serviced off-site, follow maintenance return verification procedures

Tools, Technologies, and Solutions

Mobile Device Management (MDM)

Full-Disk Encryption (FDE)

Device Tracking and Remote Wipe

Secure Transport Cases

VPN Solutions for Off-Site Access

Policy and Procedure Templates

Equipment Off-Site Policy Template

Off-Site Equipment Request Form Template

Risk Assessment and Treatment

Risk Assessment Matrix for Equipment Off-Site

Audit and Compliance Checklist

Internal Audit Checklist (30 Questions)

Policy and Documentation (5 Questions)

1. Is an equipment off-site policy documented and approved?
2. Are authorization procedures documented?
3. Are security requirements for off-site equipment documented?
4. Are lost/stolen equipment procedures documented?
5. Is the policy reviewed annually?

Authorization (5 Questions)

6. Is all off-site equipment formally authorized?
7. Is authorization documented in the off-site register?
8. Are authorization levels appropriate to equipment sensitivity?
9. Are annual remote work authorizations current?
10. Is authorization revoked when employees leave or change roles?

Technical Controls (5 Questions)

11. Is full-disk encryption enabled on all off-site laptops?
12. Are all off-site devices enrolled in MDM?
13. Is remote wipe capability enabled and tested?
14. Is device tracking enabled on all off-site devices?
15. Is VPN required and configured for off-site access?

Transport and Destination (5 Questions)

16. Are secure transport cases provided for sensitive equipment?
17. Are courier services vetted and authorized?
18. Are home office security requirements defined and communicated?
19. Are public space security guidelines communicated?
20. Are client site security requirements defined?

Return and Monitoring (5 Questions)

21. Is return verification performed for all off-site equipment?
22. Is the off-site equipment register accurate and current?
23. Are overdue returns tracked and escalated?
24. Are lost/stolen incidents reported within 1 hour?
25. Is remote wipe initiated promptly for lost/stolen devices?

Training and Awareness (5 Questions)

26. Have all employees received off-site equipment security training?
27. Are employees aware of lost/stolen reporting procedures?
28. Have managers received authorization training?
29. Are quick reference guides available?
30. Is off-site security included in onboarding?

Audit Scoring

• 30–27: Excellent (Green), Full compliance
• 26–22: Good (Yellow), Minor gaps, address within 30 days
• 21–15: Needs Improvement (Orange), Significant gaps, address within 60 days
• 14–0: Critical (Red), Major non-compliance, immediate action required

Metrics and KPIs

Key Performance Indicators

Common Pitfalls and How to Avoid Them

Pitfall 1: "It Won't Happen to Us"

Problem: Organizations assume their employees are careful and equipment won't be lost or stolen. They skip encryption, MDM, and tracking to save overhead. Solution: Implement mandatory controls for all off-site equipment. Encryption and MDM are not optional, they are insurance. The impact of prevention is a fraction of the impact of a breach. Train employees on the real risks. Share statistics and illustrative scenarios. Make it a policy, not a choice.

Pitfall 2: Inadequate Home Office Security

Problem: Remote workers set up home offices with no security consideration. Equipment is shared with family, Wi-Fi is unsecured, and workspace is in a common area. Solution: Implement home office security requirements. Provide a checklist for remote workers. Require annual self-assessment. Provide guidance on secure Wi-Fi setup. Include home office security in remote work authorization. Do not assume that "home" means "secure."

Pitfall 3: No Tracking of Off-Site Equipment

Problem: Equipment is taken off-site with no tracking, no register, and no follow-up. Equipment is lost, forgotten, or never returned without detection. Solution: Maintain an off-site equipment register. Use automated check-in/check-out. Set up overdue reminders. Conduct periodic audits. Include off-site equipment in the asset inventory. Make tracking a routine part of IT operations, not an afterthought.

Pitfall 4: Ignoring the Return Verification

Problem: Equipment is returned but never checked for security, malware, or unauthorized modifications. A compromised device is reconnected to the corporate network. Solution: Implement mandatory return verification. Scan for malware. Verify security settings. Check for unauthorized software or data. Compare against baseline. Do not assume a returned device is "clean." Treat every returned device as potentially compromised until verified.

Pitfall 5: Overly Restrictive Off-Site Policy

Problem: Policy is so restrictive that employees cannot work effectively off-site. They find workarounds (personal devices, unauthorized cloud storage, paper notes) that create greater risk. Solution: Balance security with usability. Provide approved tools and methods for off-site work. Enable VPN, cloud access, and secure file sharing. Train employees on approved alternatives. The goal is to enable secure work, not prevent work.

Pitfall 6: No Response Plan for Lost/Stolen Devices

Problem: When a device is lost or stolen, there is confusion about who to notify, what to do, and whether to remote wipe. Valuable time is lost, and data exposure risk increases. Solution: Document and communicate a clear response plan. Include: who to notify (IT Security, manager, HR), how to initiate remote wipe, how to assess breach risk, whether to file police report, and how to handle insurance. Test the plan with a drill. Make sure every employee knows the 1-hour reporting requirement.

Pitfall 7: Forgetting Backup Media Transport

Problem: Backup tapes, USB drives, and external hard drives are transported off-site without authorization, encryption, or tracking. They are lost or stolen with no detection. Solution: Include all media in the off-site policy. Backup media must be encrypted. Transport must be authorized. Use secure cases. Use tracked couriers. Document chain of custody. Do not allow employees to casually carry backup media off-site without controls.

Pitfall 8: Assuming Cloud Eliminates Off-Site Risk

Problem: Organization assumes that because data is "in the cloud," off-site device risk is eliminated. Employees access cloud data from unsecured devices with no controls. Solution: Cloud data is still accessed via devices. Device security is still critical. Implement conditional access: only managed, encrypted, compliant devices can access corporate cloud resources. Use Zero Trust architecture. Do not let cloud adoption reduce endpoint security.

Illustrative Scenarios

Illustrative scenario, a composite example for guidance, not a specific Singahi engagement or a verified outcome.

Illustrative Scenario 1: Indian Consulting Firm, Remote Work Security Overhaul (Growing company)

Organization: A 300-employee management consulting firm in Delhi with consultants traveling to client sites across India and abroad Challenge: The firm's consultants routinely carried laptops with highly confidential client data (merger strategies, financial projections, organizational restructuring plans) to client sites, hotels, and co-working spaces. The laptops had no encryption, no MDM, and no tracking. A consultant's laptop was stolen from a hotel room in Mumbai during a client engagement. The laptop contained unencrypted merger plans for a major Indian conglomerate. The plans were leaked to the media, causing the deal to collapse and the client to sue the consulting firm for in damages. Before State:

• 300 laptops with no encryption
• No MDM or remote wipe capability
• No off-site authorization process
• No tracking of off-site equipment
• No return verification
• Consultants used personal devices for client work without controls
• No VPN requirement; consultants connected directly to client networks or public Wi-Fi
• No lost/stolen device response plan

Implementation: Month 1: Emergency response. Engaged legal counsel. Negotiated with client. Implemented interim controls (password changes, account monitoring). Month 2: Deployed full-disk encryption (BitLocker) on all 300 laptops. Month 3: Deployed Microsoft Intune MDM with remote wipe, tracking, and conditional access. Month 4: Implemented off-site authorization process with security verification. Month 5: Deployed Cisco AnyConnect VPN with mandatory use for all off-site access. Month 6: Implemented return verification procedures. Month 7: Trained all consultants on off-site security, incident reporting, and home office security. Month 8: Conducted simulated lost device drill. Month 9: Internal audit. All controls passed.

Results (After 12 Months):

• 100% laptop encryption coverage
• 100% MDM enrollment
• 100% off-site authorization compliance
• 100% VPN usage for off-site access
• 2 subsequent lost devices; both recovered via tracking; remote wipe not needed
• Zero data breaches from off-site equipment
• Client trust restored; new clients signed citing security posture
• Insurance premiums reduced by 12% due to demonstrated risk reduction

Investment: (encryption, MDM, VPN, authorization system, training, legal fees) ROI: Avoided lawsuit and potential bankruptcy. The firm's reputation was severely damaged but recovered over 18 months. The investment in security was a fraction of the potential overhead. The firm is now a model for consulting industry security practices.

Key Lesson: Consulting firms are high-risk for off-site equipment breaches because their business model involves carrying sensitive client data to third-party locations. Encryption, MDM, and authorization are not optional, they are essential business protections.

Illustrative Scenario 2: Large Indian Bank, Branch Equipment and Backup Media Transport Standardization

Organization: A national bank with 1,500 branches across India, 20,000+ employees Challenge: The bank's branches used laptops for manager mobility, backup tapes for daily backups, and portable hard drives for inter-branch data transfer. Equipment was transported without standard security controls. A backup tape was lost in a taxi in Chennai; the tape was unencrypted and contained daily transaction data for the branch. The incident was not reported for 3 days. The bank faced RBI inquiry and potential penalties. A review revealed that 40% of branches had no off-site equipment policy, 60% of backup tapes were unencrypted, and no branch tracked equipment taken off-site. Before State:

• 1,500 branches with inconsistent off-site equipment controls
• 3,000+ laptops with varying encryption status
• 1,500 backup tapes transported daily with no encryption
• No centralized off-site equipment register
• No remote wipe capability for branch laptops
• No courier authorization for backup tape transport
• No return verification for equipment taken off-site

Implementation: Phase 1 (Months 1–2): Developed national off-site equipment policy with branch-specific requirements. Phase 2 (Months 3–4): Assessed all 1,500 branches. Prioritized by transaction volume and risk. Phase 3 (Months 5–10): Deployed encryption on all 3,000+ laptops. Deployed MDM with remote wipe. Encrypted all backup tapes. Implemented secure courier service for tape transport. Phase 4 (Months 11–13): Implemented centralized off-site equipment register. Trained branch managers and IT staff. Phase 5 (Months 14–15): Conducted national internal audit. All branches compliant. Phase 6 (Month 16): RBI re-audit. All findings cleared.

Results (After 18 Months):

• 100% of branch laptops encrypted
• 100% of backup tapes encrypted
• 100% of branches with off-site equipment register
• 100% of branches with remote wipe capability
• 100% of courier services vetted and authorized
• Zero lost backup tape incidents
• 3 lost laptops; all recovered via MDM tracking within 24 hours
• RBI audit: zero off-site equipment deficiencies
• Customer trust scores improved; branch security ratings increased

Investment: (encryption, MDM, tape encryption, courier service, register, training, audit) ROI: Avoided RBI penalties estimated at . Prevented recurrence of the backup tape incident, which would have overhead an estimated in customer notification and remediation. The standardized approach enabled centralized management and reduced per-branch security overhead.

Key Lesson: Distributed organizations (banks, retail, manufacturing) face compounded off-site equipment risk because every branch or location is a potential breach point. Standardization and centralized control are essential for managing risk at scale.

Multi-Framework Mapping

ISO 27001:2022 A.7.9 to Other Frameworks

NIST 800-53 Rev 5:

• PE-2: Physical Access Authorizations, Maps to off-site equipment authorization
• AC-17: Remote Access, Maps to remote work and off-site access controls
• SC-28: Protection of Data at Rest, Maps to encryption for off-site equipment
• CM-8: System Component Inventory, Maps to off-site equipment tracking

PCI DSS v4.0:

• Requirement 9.5: Physical security of media and hardware, including off-site
• Requirement 3.4: Display of cardholder data; encryption for off-site devices

SOC 2 CC6.1:

• Logical and physical access controls for all devices, regardless of location

CIS Controls v8:

• CIS Control 3.10: Encrypt Sensitive Data, Encryption for off-site devices
• CIS Control 4.6: Securely Dispose of Assets, Remote wipe for lost devices

Regulatory and Industry Context

India-Specific Regulatory Requirements

Digital Personal Data Protection (DPDP) Act 2023:

• Section 8(5): Reasonable security safeguards for personal data on all devices, including off-site
• Breach notification required within 72 hours if off-site device loss exposes personal data
• Penalties up to for failure to protect personal data
• Data fiduciaries must ensure off-site devices with personal data are encrypted and protected

RBI Cyber Security Framework:

• All devices containing customer data that leave the premises must be encrypted
• Backup media transported off-site must be encrypted
• Lost or stolen devices must be reported and investigated
• Annual cyber audit must include off-site equipment security review

SEBI Cybersecurity Circular:

• Trading equipment taken off-site requires authorization and enhanced security
• Remote access to trading systems requires multi-factor authentication and encryption
• Loss of trading equipment must be reported immediately

IRDAI Guidelines:

• Insurance customer data on portable devices must be encrypted
• Off-site equipment must meet minimum security standards

Information Technology Act 2000 (as amended):

• Section 43A: Compensation for failure to protect sensitive personal data on off-site devices
• Section 66C: Identity theft applicable to stolen devices containing identity data

Industry-Specific Context

BFSI:

• RBI mandates encryption for all laptops and mobile devices with customer data
• Backup tape transport must use encrypted tapes and authorized couriers
• ATM maintenance equipment taken off-site must be secured and tracked
• Branch manager laptops must have remote wipe capability

Healthcare:

• Patient data on portable devices must be encrypted (equivalent to HIPAA requirements)
• Medical devices taken to patient homes must be secured
• Home care workers' devices must meet security standards
• NABH accreditation requires off-site equipment security

Consulting/Legal:

• Client confidential data on consultant laptops is a high-risk scenario
• Off-site work at client sites requires enhanced security
• Client contracts often require specific off-site security controls
• Professional liability insurance requires demonstrated security practices

SaaS/Cloud:

• Employee laptops with admin access to cloud infrastructure are critical assets
• Portable demo environments must be secured
• Customer data on off-site devices must meet contractual requirements
• Off-site device security is often audited by enterprise clients

Roles and Responsibilities (RACI)

Documentation and Evidence Requirements

Continuous Improvement

Maturity Model for A.7.9

Continuous Improvement Activities

Monthly:

• Off-site register review and reconciliation
• Overdue return follow-up
• Lost/stolen incident review
• MDM compliance report review

Quarterly:

• Off-site equipment authorization audit
• Remote wipe capability testing
• Home office security assessment sampling
• Internal audit of off-site controls
• Training effectiveness assessment

Annually:

• Full policy review
• Complete risk assessment refresh
• Technology and tool evaluation
• Benchmark against industry best practices
• External audit preparation
• Maturity assessment against target level

Trigger-Based:

• After any lost/stolen equipment incident
• Upon new off-site work arrangement (new branch, new client, new travel program)
• Upon new technology adoption (new device types, new cloud services)
• After significant audit findings
• Upon regulatory change

FAQ

Q1: Do all laptops need encryption if they ever leave the office? A: Yes. If a laptop leaves the office even once, it should be encrypted. The risk of loss or theft exists from the first off-site trip. Encryption is the most effective control for protecting data on lost or stolen devices. Full-disk encryption should be mandatory for all laptops, regardless of how frequently they leave the office.

Q2: What about employees who occasionally work from home, do they need the same controls as frequent travelers? A: Yes, but with some flexibility. All remote workers need encryption, VPN, and screen lock. Home office security requirements apply to all remote workers, but the assessment can be less intensive for occasional remote workers. Frequent travelers need additional controls: privacy filters, secure transport cases, travel security briefings, and enhanced tracking. Apply risk-based controls: the more frequent and high-risk the off-site use, the more controls required.

Q3: Can we allow employees to use personal laptops for work instead of company laptops? A:** Not recommended for handling sensitive data. If you must allow BYOD (Bring Your Own Device), implement strict controls: (1) MDM enrollment with containerization, (2) Full-disk encryption, (3) VPN required, (4) Application control, (5) Remote wipe capability, (6) Regular security scans, (7) Clear separation of work and personal data, (8) Employee agreement on security requirements. BYOD is convenient but creates significant security and legal challenges. Company-managed devices are always preferable for sensitive work.

Q4: How do we handle equipment taken to high-risk countries? A:** High-risk countries (countries with high crime rates, political instability, or aggressive cyber espionage) require enhanced controls: (1) CISO approval required, (2) Dedicated high-security laptop with minimal data, (3) No sensitive data stored locally (use remote desktop), (4) Enhanced tracking and geofencing, (5) Travel security briefing, (6) Duress alarm or panic code, (7) Tamper-evident case, (8) Enhanced return verification including forensic analysis, (9) Consider "burner" devices that are wiped and reimaged after return. Some organizations prohibit taking company equipment to specific high-risk countries.

Q5: What is the difference between a VPN and a Zero Trust approach for off-site access? A:** A VPN creates an encrypted tunnel between the off-site device and the corporate network. All traffic goes through the tunnel. Zero Trust assumes no device or user is trusted by default, regardless of location. Zero Trust uses continuous authentication, device health checks, least-privilege access, and micro-segmentation. VPN is a network-level control. Zero Trust is an architecture-level approach. Both can be used together: VPN for network access, Zero Trust for application and data access. For modern security, Zero Trust is increasingly preferred over traditional VPN.

Q6: Do we need to insure off-site equipment? A:** Yes, equipment insurance is important for off-site devices. Check your current property insurance policy, it may not cover off-site equipment or may have limitations. Consider: (1) Cyber insurance that covers data breach overhead from lost devices, (2) Equipment insurance that covers replacement overhead, (3) Professional liability insurance if client data is exposed. Insurance does not replace security controls but provides financial protection when controls fail.

Q7: How do we track equipment that is permanently off-site (e.g., at a branch office)? A:** Permanently off-site equipment at branch offices or remote locations should be treated as a separate asset location, not as "off-site" in the traditional sense. It should be: (1) Included in the asset inventory with its permanent location, (2) Subject to the same security controls as on-site equipment (encryption, access control, monitoring), (3) Included in regular audits and inspections, (4) Subject to the same maintenance and disposal procedures. The key is that the equipment is not "traveling", it has a fixed off-site location with its own security controls.

Q8: What about equipment taken to conferences or trade shows? A:** Conferences and trade shows are high-risk environments for equipment theft and shoulder surfing. Requirements: (1) Conference-specific authorization, (2) Minimal data on demonstration devices (use sanitized demo data), (3) No sensitive work in conference spaces, (4) Equipment locked in hotel safe when not in use, (5) Privacy filters for any screens, (6) No public Wi-Fi without VPN, (7) Enhanced return verification, (8) Travel insurance for equipment. Consider using dedicated "conference laptops" that contain only demo data and are reimaged after each event.

Q9: How do we handle equipment that employees take home permanently (e.g., during COVID-19 remote work transition)? A:** Permanent home use requires the same controls as office use, plus home office security: (1) Encryption, MDM, VPN are mandatory, (2) Home office security assessment, (3) Dedicated workspace with lockable storage, (4) Secure Wi-Fi, (5) Clear desk/screen policy, (6) No family access, (7) Regular security scans, (8) Annual re-assessment of home office security. Do not treat permanent home use as "temporary", it requires the same rigor as a permanent office location.

Q10: What is the most common audit finding for A.7.9? A:** Inadequate authorization and tracking. Common findings: equipment taken off-site without authorization, no off-site equipment register, no encryption on laptops, no MDM enrollment, no return verification, and no lost/stolen response plan. Auditors will check the register, verify encryption status, test remote wipe, and review incident response procedures.

Q11: How do we enforce off-site security for employees who resist controls? A:** Make compliance a condition of off-site work privileges. If employees cannot or will not comply with security requirements, they do not receive off-site equipment authorization. Provide approved alternatives (desktop-only work, cloud-based remote desktop with no local data). Frame it as enabling secure work, not punishing employees. Most employees understand once the risks are explained. For persistent non-compliance, escalate to HR and management.

Q12: What about equipment taken by departing employees? A:** Departing employees must return all company equipment before their last day. Create a return checklist: (1) Laptop and charger, (2) Mobile devices, (3) USB drives and peripherals, (4) Access cards and keys, (5) Remote wipe any device that cannot be returned. Do not allow departing employees to "keep" old equipment without formal authorization, sanitization, and removal from inventory. Departing employees are a high-risk group for data exfiltration.

Q13: How do we handle equipment that is lost but we are not sure if it was stolen or just misplaced? A:** Treat all lost equipment as a potential security incident until proven otherwise. Initiate remote wipe immediately (you can cancel it if the device is found). Report it as lost/stolen to IT Security. Begin incident response procedures. If the device is found, perform enhanced return verification. If it is not found within a reasonable time (e.g., 24 hours), treat it as a confirmed loss and complete breach assessment. It is better to overreact to a misplaced device than underreact to a stolen one.

Q14: How much does implementing A.7.9 overhead for a growing company? A:** For a 200-person company with 200 laptops: encryption (–via BitLocker/FileVault which are free with OS licenses, or paid solutions), MDM (–/year), VPN (–/year), tracking tools (–), secure cases (–), training (–). Total: –/year. Many components (BitLocker, FileVault, Find My Device) are free, reducing overhead significantly.

Q15: Can we use GPS tracking for all off-site devices? A:** GPS tracking is useful for high-value and high-sensitivity devices, but it raises privacy concerns for employees. Best practice: (1) Use GPS tracking for high-risk devices (e.g., devices with Secret data, demo kits with sensitive data), (2) Use MDM-based location tracking for general devices (coarse location, not continuous GPS), (3) Inform employees that tracking is enabled and why, (4) Use tracking only for security purposes, not employee monitoring, (5) Disable tracking when device is returned to the office. Balance security benefits with employee privacy expectations.

References and Further Reading

Standards and Frameworks

• ISO/IEC 27001:2022, Information Security, Cybersecurity and Privacy Protection, Information Security Management Systems, Requirements
• ISO/IEC 27002:2022, Information Security, Cybersecurity and Privacy Protection, Information Security Controls
• NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations
• NIST SP 800-114 Rev 1, User's Guide on Securing Mobile Devices
• PCI DSS v4.0, Payment Card Industry Data Security Standard
• CIS Controls v8, CIS Controls Version 8

Indian Regulations

• Digital Personal Data Protection Act, 2023 (India)
• Information Technology Act, 2000 (as amended)
• RBI Cyber Security Framework for Banks
• SEBI Circular CIR/ISD/2019 on Cyber Security and Cyber Resilience

Books and Publications

• ISO 27001/27002: A Pocket Guide by Alan Calder
• NIST 800-114: User's Guide on Securing Mobile Devices (NIST)
• The Security Handbook by Gerald L. Kovacich and Edward Halibozek

Off-Site Equipment Security by Scenario

Remote Work (Work From Home)

Business Travel

Off-Site Maintenance and Repair

Off-Site Storage (Backup Tapes, Archives)

Off-Site Security Incident Response

Incident Response Playbook for Lost/Stolen Off-Site Equipment

INCIDENT: Off-Site Device Lost or Stolen

IMMEDIATE RESPONSE (0-4 hours):
1. REPORT: Employee reports loss to IT Security immediately
2. ASSESS: Determine device classification, data sensitivity, encryption status
3. WIPE: Initiate remote wipe if device is online and MDM-enabled
4. LOCK: Disable all accounts associated with device (AD, VPN, cloud)
5. TRACK: Attempt device tracking (Find My Device, MDM location)
6. NOTIFY: Notify CISO, Legal, HR, and relevant data owners

SHORT-TERM RESPONSE (4-24 hours):
7. INVESTIGATE: Determine how loss occurred, timeline, potential data exposure
8. EVIDENCE: Preserve logs, screenshots, tracking data, police report
9. DPDP: Assess DPDP Act 2023 notification requirement (if PII involved)
10. REGULATORY: Notify relevant regulators if required (RBI, SEBI, CERT-In)
11. POLICE: File police report (FIR) for stolen devices
12. COMMUNICATION: Prepare internal and external communication if needed

MEDIUM-TERM RESPONSE (1-7 days):
13. REPLACE: Issue replacement device (clean image, encrypted, configured)
14. REVIEW: Review off-site security policy, identify gaps
15. TRAINING: Retrain employee on off-site security practices
16. LESSONS: Conduct post-incident review, document lessons learned
17. UPDATE: Update policy, procedures, and training based on findings

LONG-TERM RESPONSE (1-4 weeks):
18. AUDIT: Conduct audit of all off-site devices, verify compliance
19. ENHANCE: Implement additional controls if needed (GPS tracking, better cases)
20. MONITOR: Enhanced monitoring for affected accounts and data
21. CLOSURE: Close incident, archive evidence, update risk register

Additional Illustrative Scenarios: Indian Off-Site Equipment Incidents

Illustrative Scenario 3: Indian Consultant, Laptop Theft at Client Site (2023)

What happened: A management consultant from a Delhi-based consulting firm had their laptop stolen from a client conference room during a lunch break. The laptop contained confidential strategy documents for 5 clients, including a major competitor analysis for a listed company.

Impact:

• 5 client confidentiality breaches
• SEBI notification required for listed company strategy leak
• Client contracts cancelled (3 clients, annual revenue)
• Legal action from clients for breach of NDA
• Consultant terminated, firm faced reputational damage
• Remediation overhead: (legal, client notification, system changes, insurance claim)

Root causes:

• Laptop left unattended in client conference room
• No cable lock used (available but not mandatory)
• No automatic screen lock (set to 30 minutes)
• No full disk encryption (IT policy required but not enforced)
• No remote wipe capability (MDM not deployed)
• No incident response plan for off-site device theft

Lessons:

• Never leave devices unattended in client areas (even for short breaks)
• Mandate cable locks for all laptops at client sites
• Enforce 5-minute screen lock on all devices (MDM policy)
• Enforce full disk encryption on all devices (no exceptions)
• Deploy MDM with remote wipe on all off-site devices
• Develop incident response playbook specifically for off-site incidents
• Include off-site security in client onboarding (client premises rules)
• Provide secure carrying cases with locks for consultants

Illustrative Scenario 4: Indian Bank, Backup Tape Lost in Transit (2022)

What happened: A bank in Mumbai was transporting backup tapes to an off-site storage facility. The courier vehicle was involved in a traffic accident, and the backup tapes (in a supposedly locked container) were stolen from the vehicle while the driver was dealing with the accident. The tapes contained 6 months of customer transaction data.

Impact:

• 6 months of customer transaction data potentially exposed
• RBI notification required within 2 hours (bank reported after 24 hours)
• RBI penalty: for inadequate data protection during transport
• Customer notification required (50,000+ customers)
• Media coverage, customer trust erosion
• Remediation overhead: (investigation, notification, legal, system changes)
• Bank changed to encrypted cloud backup, discontinued tape transport

Root causes:

• Backup tapes not encrypted (despite policy requiring encryption)
• Transport container lock was a standard padlock (easily cut)
• No GPS tracking on transport vehicle
• No courier escort (single driver)
• No chain of custody documentation
• No real-time tracking of transport
• Incident response delayed (24 hours instead of 2 hours)

Lessons:

• Encrypt all backup tapes before transport (no exceptions)
• Use tamper-evident seals and secure containers for transport
• Implement GPS tracking on all transport vehicles carrying sensitive media
• Use dual-courier escort for high-sensitivity media transport
• Implement chain of custody documentation (sign-off at each handover)
• Use real-time tracking with alerts for route deviations or delays
• Consider cloud backup as alternative to physical tape transport
• Implement immediate incident response (within 2 hours for RBI)
• Regular audit of transport security (quarterly)
• Insurance for transport-related data loss

This guide is part of the Singahi ISO 27001:2022 Annex A Control Guide Series.