ISO/IEC 27001:2022 A.7.9 — Security of assets off-premises

What this control requires

Off-site assets shall be protected.

In plain English

Off-site assets shall be protected. In practice, this means you can prove you policy assets-level controls on a defined cadence.

Why it matters

ISO 27001 certification depends on showing each Annex A control is either implemented or explicitly justified for exclusion in the Statement of Applicability (SoA). Certification bodies sample controls during surveillance audits, and a missing SoA entry — or implementation that doesn't match the SoA wording — is a finding.

What an auditor looks for

An ISO 27001 lead auditor looks for: (1) an SoA entry covering the control with justification, (2) a documented procedure or policy implementing it, (3) records that prove the procedure runs (logs, tickets, training records) and (4) management-review evidence that effectiveness is monitored.

Within Physical controls, the assessor will trace your implementation back to the catalogue reference (Annex A A.7.9) and look for objective evidence on the latest two assessment cycles.

How to implement

Physical Security

Inheritance. For cloud-only operations, inherit physical controls from the provider's SOC 2 / ISO 27001 report and document the inheritance in the SoA.

Policy Management

Docs. Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA.

Operational checklist

• Policy. Document the trigger, the owner and the cadence.
• Management. Document the trigger, the owner and the cadence.
• Physical. Document the trigger, the owner and the cadence.
• Security. Document the trigger, the owner and the cadence.
• Scope: assets, management, assets off-premises, security.

Evidence to collect

• Policy Document. A signed and version-controlled policy / standard / procedure document.
• Infra Scan. Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings.

Signed policy or standard documents the safeguard. Focus: Security of assets off-premises.

Common pitfalls

• Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

• HIPAA (45 CFR Part 164) 164.308(a)(5)(i) — Security Awareness and Training
• NIST SP 800-171 Rev. 3 3.10.2 — Monitoring Physical Access
• SOC 2 (2017 TSC) CC6.7 — Transmission Controls
• BSI C5:2020 SP-01 — Documentation, communication and provision of policies and instructions
• NIST SP 800-53 Rev. 5 PL-2(3) — Plan And Coordinate With Other Organizational Entities

Related controls in ISO/IEC 27001:2022

• Annex A A.7.1 — Physical security perimeters
• Annex A A.7.3 — Securing offices, rooms and facilities
• Annex A A.7.8 — Equipment siting and protection
• Annex A A.7.14 — Secure disposal or re-use of equipment
• Annex A A.7.6 — Working in secure areas
• Annex A A.7.10 — Storage media

References

• ISO/IEC JTC 1/SC 27 — ISO/IEC 27001:2022
• Catalogue identifier: Annex A A.7.9

Topics: governance riskphysical securitypolicy management