A.7.9 A.7 · Physical Controls

A.7.9 — Security of assets off-premises

Apply security to assets taken off-site, taking into account the different risks of working outside the organisation's premises.

Also written as A7.9, Annex A 7.9, ISO 27001:2022 A.7.9, ISO27001 A.7.9.

Written by Jett N. · Last reviewed

What ISO 27001 A.7.9 requires

Security of assets off-premises is one of 14 Physical Controls in ISO/IEC 27001:2022 Annex A. Apply security to assets taken off-site, taking into account the different risks of working outside the organisation's premises. Physical controls are usually verified by walkthrough as well as by document review, so what an auditor observes on site has to match what the procedure claims — badge logs and visitor records are the standard corroboration.

Audit evidence assessors look for

When preparing your Statement of Applicability (SoA) for A.7.9, gather artefacts such as:

  • Off-site asset register and tracking process
  • Full-disk encryption on laptops and mobile devices
  • Off-premises asset use policy and approval process
  • Remote wipe capability evidence for mobile devices

How A.7.9 maps to SOC 2 and NIST CSF

If you run more than one framework, the same evidence usually satisfies all of them. A.7.9 aligns with:

SOC 2: CC6.4 Physical access restriction, CC6.7 Protection of data in transmission and movement

NIST CSF 2.0: ID.AM-01 Hardware inventory, PR.AA-06 Physical access management, PR.DS-01 Data-at-rest protection

ISO 27001:2013 mapping

A.7.9 consolidates the following ISO 27001:2013 control(s): A.11.2.6. If you are transitioning an existing ISMS, map your prior evidence for these to A.7.9 in your updated SoA.

Map A.7.9 to NIST CSF & SOC 2 →
Crosswalk this control in the Control Mapper & Gap Assessment.
Document the risk →
Record treatment for gaps against A.7.9 in the Risk Register.

Related Annex A controls

A.7.7 Clear desk and clear screen A.7.1 Physical security perimeters A.7.2 Physical entry A.7.3 Securing offices, rooms and facilities A.7.4 Physical security monitoring A.7.6 Working in secure areas

See all 14 Physical Controls →

Frequently asked questions

Is ISO 27001 A.7.9 mandatory?

Annex A controls are not mandatory in the abstract. Clause 6.1.3 requires you to compare your risk treatment plan against Annex A and justify, in the Statement of Applicability, any control you exclude. If your risk assessment surfaces a risk that A.7.9 addresses, excluding it needs a documented, risk-based rationale that an auditor will test.

How do auditors test ISO 27001 A.7.9?

In two passes. First design: does a documented control exist, is it owned, and does it address the risk? Then operating effectiveness: the auditor samples records from across the audit period to confirm the control actually ran. A Stage 2 audit will typically pull several samples, so evidence that only exists for the month before the audit is a common finding.

How often should A.7.9 be reviewed?

ISO 27001 sets no fixed interval — it requires review at "planned intervals" and after significant change. Annual review is the norm most certification bodies expect, with an out-of-cycle review triggered by incidents, major system changes, restructures, or new regulatory obligations. Record the review date and outcome either way; an undated control is treated as unreviewed.

What does ISO 27001 A.7.9 map to in SOC 2 and NIST CSF?

A.7.9 aligns with SOC 2 CC6.4, CC6.7 and NIST CSF ID.AM-01, PR.AA-06, PR.DS-01. Evidence gathered for one framework will usually satisfy the others, which is the basis for a test-once, satisfy-many control library.

What was A.7.9 in ISO 27001:2013?

A.7.9 consolidates 1 control(s) from the 2013 edition: A.11.2.6. When transitioning, re-point the existing evidence rather than rebuilding it — the underlying requirement has not changed materially.