A.5.11
Return of assets
Organizational controlsCheckpoints 6Evidence 6Cases 5
Control objective
This control requires that personnel and external parties return all organizational assets they received or accessed for their work when their employment/contract/agreement changes or ends. When return is missed, information can be taken out without authorization, residual access can persist after departure or transfer, and assets can be lost, undermining the accuracy of the asset inventory. The scope of return covers not only physical devices such as laptops and mobile phones but also documents, removable media, authentication tokens, intellectual property, and the accounts/privileges controlled by the organization; where an asset cannot be physically returned, the associated information must be transferred, deleted, or its access blocked.
Key checkpoints
- Are the scope and list of assets to be returned defined in advance for retirement/job change/contract termination, so it can be reconciled one-to-one against the assets issued to each individual?
- Is the asset return procedure linked to the HR/contract-termination process so it runs without omission, and are return confirmation records (signatures/confirmation forms) kept?
- Are unnecessary physical/logical access rights revoked at the effective time of departure or contract termination, or earlier according to risk, regardless of delayed asset return?
- For assets that are hard to return (work information stored on personally owned devices, cloud accounts), are measures for information transfer/deletion/access blocking in place, and are the results verified?
- Is intangible knowledge such as work know-how handed over and documented?
- Is the risk of delayed or non-returnable assets assessed, and are compensating controls applied?
Implementation guidance
- Register assets in the inventory at issuance and assign a custodian, so that at return the issued items can be reconciled to verify recovery.
- Include asset return items in the retirement/job-change/contract-expiry checklist, and clearly define the roles and processing order across HR, general affairs, security, and IT functions.
- Define, by asset type (laptops/mobiles/removable media/smart cards/tokens/keys/access cards/security documents), the return method and verification steps (wiping, confirmation of data deletion, inspection before reissue).
- Transfer organizational data from BYOD to organizational storage and selectively delete it within authorized procedures and legal authority. Protect personal content and required records, and document deletion results or limitations considering device support and connectivity.
- Revoke accounts, sessions, tokens, and physical access at the effective departure/termination time or earlier according to risk, without waiting for asset return. On role change, remove rights no longer needed; track unreturned assets separately and apply safeguards such as access blocking.
- Keep evidence such as return confirmation forms/signatures, and update the asset status (returned/disposed/reissued) in the inventory to keep it consistent with the actual holdings.
Evidence
- Asset return procedure/guideline and retirement/job-change/contract-termination checklist
- Per-individual asset issuance/return ledger and return confirmation forms (signed)
- Records of account/privilege revocation (disable logs, access-right deletion records)
- Records of BYOD/mobile device remote wipe/selective wipe results
- Risk assessment and compensating control records for delayed/non-returnable assets
- Records of wiping/data deletion inspection performed on returned assets before reissue
Nonconformity examples
- A laptop/storage media returned by a leaver is reissued or left unattended without wiping, so the previous user's information remains.
- A return procedure is documented, but no actual return confirmation records exist, so recovery of issued assets cannot be evidenced.
- The access card/account of an external party whose contract has ended is not revoked, so physical/logical access remains possible after termination.
- No deletion procedure exists for customer information/business materials stored on BYOD devices, so work information remains on personal devices after departure.
- On a job change, the privileges/tokens used for the previous role are not revoked, so unnecessary privileges accumulate.