ISO 27001 Annex A return of assets: A.5.11 offboarding

The due-diligence questionnaire asks how you handle leavers. Your honest answer is an email thread, a spreadsheet last touched in spring and a laptop nobody can place. This guide covers ISO 27001 Annex A return of assets, control 5.11, for the security, IT and compliance leads who own offboarding at a 25–250 person UK firm.

You will get the plain-English requirement, the full asset scope and the steps to implement it. You will also see the evidence an auditor samples and the automation that runs most of it for you. The work is days, not weeks, and the proof it leaves is the proof buyers ask for.

What does ISO 27001 Annex A 5.11 require?

ISO 27001 Annex A 5.11 requires everyone who leaves, or changes role, to return the organisation's assets, as a formal step in the leaver process. The assets cover devices, media, keys, badges, data and knowledge. It is a preventive control: it takes company property out of a departing person's hands before it can be misused.

The recovery has to be a triggered step, not something IT remembers to chase. The control also treats the notice period as a risk window, where copying company material is actively discouraged and watched. Where kit cannot come back, such as a personal phone used for work, the duty becomes recovering the data and proving it was deleted.

The preventive classification matters because the control closes the exposure instead of detecting it afterwards. It touches confidentiality, integrity and availability together. An unreturned laptop is a confidentiality problem, while an unrecovered admin password or encryption key threatens the integrity and availability of the systems it guards. In practice it sits between asset management and HR: it is the point where the asset register meets the leaver workflow.

Three neighbouring controls shape how you build it:

• Annex A 5.9, inventory of information and other associated assets: you can only recover what your inventory says is out there.
• Annex A 5.18, access rights: it removes the access that accompanies a departure.
• Annex A 6.5, responsibilities after termination or change of employment: it covers the duties that survive employment.

If you certified against the 2013 edition, this is familiar ground. The 2022 control carries forward 2013 A.8.1.4 with a more explicit picture of what has to come back: endpoint hardware, tokens and keys, documents. A checklist or return of assets policy built on the old control usually needs a light refresh, not a rebuild.

Which assets does the return-of-assets control cover?

The control covers anything the firm issued or owns: laptops, phones, storage media, badges, keys, hardware tokens and paper files. It also covers intangibles such as admin credentials, signing keys and undocumented operational knowledge that exists only in one person's head. A checklist that lists only hardware misses the assets most likely to hurt.

A working scope for the checklist:

• Endpoints: laptops, phones, tablets and any peripheral that stores data.
• Removable media: USB drives, external disks and backup media.
• Physical access: badges, door keys and safe keys.
• Tokens and key material: hardware security keys, smart cards and signing keys.
• Paper: notebooks, printed contracts and customer lists.
• Company data on personal devices: the duty is recovering the data, not the device.

Intangibles need a named owner and a handover date. The "only Dave knows how the deploy works" problem is an asset-return failure. Runbooks, admin credentials and key material must transfer before the last day, or the firm loses availability when the person walks out.

Scope is where firms slip. Most ISO 27001 return of assets checklists stop at hardware and frame offboarding as an employee process. Contractors, temps and supplier staff hold laptops, badges and admin credentials too. Put the return wording into their agreements and track their kit on the same register.

Why is the notice period the riskiest window for company assets?

The notice period is when a leaver still has legitimate access and every chance to copy material, so it is the easiest time for data to walk out. For a regulated firm, client data on an unrecovered laptop may be a reportable breach. A sole admin password leaving with its owner is a single point of failure.

The ICO personal data breach response guidance points to remote wipe as the containment step for a stolen laptop. A breach that meets the reporting threshold must reach the ICO within 72 hours of discovery. A device that left with a departed employee and was never recorded as returned undermines both. You cannot wipe a laptop you cannot find, and you cannot judge what it held without a register naming who held it.

The exposures worth designing against:

• Data copied during notice: exports, forwarded email and personal cloud uploads in the final weeks.
• Unrecovered devices: client data sitting on kit outside your control.
• Single points of failure: an admin password, signing key or undocumented process leaving with its owner.
• Live physical access: an ex-contractor's badge that still opens the door.

Enterprise due-diligence questionnaires ask about offboarding for the same reason auditors like it. The answer is cheap to test, and a mismatch is one of the easiest findings to score.

How do you implement ISO 27001 Annex A return of assets step by step?

Implementing return of assets takes days, not weeks. Make HR the trigger, put return-of-property wording in contracts, keep a register with named custodians and use a signed handback form. Cut access the same day, and sanitise returned storage before reissue. Each step produces a record an auditor can sample.

The sequence we recommend to a 50-person regulated firm:

1. Make HR the trigger. A resignation, termination or role change logged in the HR system opens the offboarding checklist automatically. Email handoffs between HR and IT are how account disablement ends up days late or never.
2. Put the duty in writing. Add return-of-property wording to employment contracts, NDAs and supplier agreements before you need it. You cannot enforce a handback nobody agreed to.
3. Keep the register honest. Record serial numbers and named custodians, so day one of offboarding starts from a list of what the person holds. Register drift turns recovery into archaeology.
4. Use a signed handback form. The leaver confirms what they returned, IT counter-signs, and register entries flip to returned or awaiting wipe. A handback with no form leaves nothing for a sampler to see.
5. Cut logical access the same day. Disable accounts, revoke MFA enrolments and certificates, and reclaim SaaS seats. Collect badges and physical keys at the exit conversation.
6. Capture knowledge before the last day. Admin credentials, key material and runbooks transfer to a named successor, and any shared passwords the leaver knew are changed.
7. Inspect and sanitise before reissue. Check returned kit for missing parts or unauthorised changes, then wipe or destroy its storage and keep the sanitisation record. Laptops piling up unwiped in a cupboard are a leak waiting to happen.

An offboarding process that starts when IT notices an empty desk isn't a process.

Build the register on the Annex A 5.9 inventory. Run the checklist as one half of the joiner-mover-leaver process with Annex A 5.18, not as a separate document. Hold the handback in the exit conversation, so badges, keys and the signature change hands in one meeting.

For remote leavers, send a prepaid, tracked return box with the handback form inside, and set a return date before the last working day. The courier's delivery record joins the leaver's evidence file, and the same-day access cut does not wait for the parcel.

How do internal movers fit into return of assets?

An internal mover is a partial leaver: the person stays, but the kit and permissions the old role justified do not. Joiner, mover and leaver processes should revoke or change access when roles change, as NCSC guidance sets out. Without that, access builds up until long-serving staff can touch everything.

The NCSC identity and access management guidance also asks for regular reviews of accounts for unnecessary privileges, with privileged access revoked once it is no longer needed. That review catches the movers your process missed. In practice, a role change in the HR system should raise the same checklist as a resignation, scoped to the difference between the old role and the new.

What a mover hands back:

• Role-specific kit: test devices, tokens or hardware the new role has no use for.
• Permissions: production access, admin rights and SaaS seats the new role doesn't justify.
• Physical access: areas such as server rooms or finance offices.
• Knowledge: a documented handover to whoever inherits the old duties.

Auditors ask this directly: an engineer moved into a customer-facing role, so what did they give up? A mover record showing removed permissions answers it in one document.

What happens when a leaver won't return an asset?

Treat a non-return as a security incident, not an admin nuisance. Record it, escalate through management, and enforce the return-of-property wording in the contract. Cut the person's logical access anyway, and keep the audit trail: the evidence of what you did matters even when recovery fails.

A workable protocol:

1. Log the incident with the item, serial number, custodian and the dates of each request.
2. Escalate in writing through the former line manager and HR, citing the contract clause.
3. Contain the data: lock or wipe the device if it is managed, and revoke its certificates and tokens.
4. Keep the register entry and mark it unrecovered, rather than deleting the item.
5. Assess personal data exposure straight away, because the ICO's 72-hour clock runs from when you discover a breach. Decide with HR and legal whether to pursue recovery formally.

The auditor's question is "what happened the last time somebody didn't return something?" A dated incident record answers it, even if the laptop never came back.

What evidence proves return of assets to an auditor?

An auditor expects a record for every leaver: what they held, what came back, when their access ended and what happened to the data. The contract wording that set the duty belongs in the file too. The strongest single artefact is a periodic leaver reconciliation, because it tests the whole process rather than one leaver at a time.

Each record proves one thing:

• Handback form: the item came back, and who accepted it.
• Register state: where the item is now.
• Identity-platform timestamp: when the leaver's access ended.
• Wipe log or deletion statement: the data is gone from the device.
• Sanitisation certificate: retired storage left the building safely.
• Contract wording: the duty existed before the exit.
• Incident record: a non-return was handled, not ignored.

The reconciliation compares the HR leaver list against register status and account-disablement dates. Auditors accept a simple spreadsheet.

A reconciliation nobody runs is a document, not a control.

File evidence per leaver, so one name yields the whole trail. Put the reviewer's name and date on every reconciliation run, and log exceptions with a closure date.

How do auditors sample leavers and grade lapses?

Auditors take names from the HR leaver list and trace each across handback forms, asset register status and account-disablement timestamps. Contractors are the favourite pick because they are most often missed. Certification bodies typically grade a missing offboarding process, or accounts left live for weeks, as major; a missing signature or a lagging register entry is minor.

Questions to expect in the room:

• "Show me your last three leavers. What did they hold, what came back, and when did their accounts die?"
• "How does IT find out that someone has resigned?"
• "This laptop is assigned to someone who left in April. Where is it now?"

Minor gaps aggregate: one missing signature is minor, but the same gap across several leavers reads as a pattern and can be graded major.

Access that outlives employment by weeks is a decision nobody made.

Run your own reconciliation the month before the audit. It finds the contractor you forgot while the fix is still cheap.

How do you automate return of assets with HR, IdP and MDM?

Offboarding is one of the most automatable controls in Annex A. An HR status change opens the ticket with the leaver's assets pre-filled. SCIM deprovisioning drops accounts when the identity provider disables the user, MDM wipes log themselves, and a scheduled job diffs leavers against active accounts. The evidence is a by-product.

Start with the scheduled reconciliation, because it works even if nothing else is automated and catches whatever the other steps miss. Connect the HR event to the ticket next, which removes the dependency on someone remembering. SCIM and MDM logging follow, using tooling you may already pay for.

Humans keep the judgment calls: whether a mover keeps a permission, how to handle a non-return, which knowledge needs transferring. The pipeline handles the timestamps and the paperwork.

The audit scramble becomes a monthly exception report that is usually empty, and the buyer's questionnaire gets a screenshot instead of a promise.

Frequently asked questions