---
notetype: reference
standard: ISO 27002
version: 2022
language: EN
type: control
id: "A.5.11"
title: "Return of assets"
theme: Organizational
control_type: [Preventive]
information_security_properties:
  - Confidentiality
  - Integrity
  - Availability
cybersecurity_concepts: [Protect]
operational_capabilities: [Asset_management]
security_domains: [Protection]
tags:
- iso27002/2022/EN
- sourcetext
status: active
---

## 5.11 Return of assets

  

### Control
Personnel and other interested parties as appropriate should return all the organization’s assets in their possession upon change or termination of their employment, contract or agreement.

### Purpose
To protect the organization’s assets as part of the process of changing or terminating employment, contract or agreement.

### Guidance

The change or termination process should be formalized to include the return of all previously issued physical and electronic assets owned by or entrusted to the organization.

In cases where personnel and other interested parties purchase the organization’s equipment or use their own personal equipment, procedures should be followed to ensure that all relevant information is traced and transferred to the organization and securely deleted from the equipment (see [7.14](a-7.14-Secure-disposal-or-re-use-of-equipment.md)).

In cases where personnel and other interested parties have knowledge that is important to ongoing operations, that information should be documented and transferred to the organization.

During the notice period and thereafter, the organization should prevent unauthorized copying of relevant information (e.g. intellectual property) by personnel under notice of termination.

The organization should clearly identify and document all information and other associated assets to be returned which can include:

a\) user endpoint devices;
b\) portable storage devices;
c\) specialist equipment;
d\) authentication hardware (e.g. mechanical keys, physical tokens and smartcards) for information systems, sites and physical archives;
e\) physical copies of information.

### Other information
It can be difficult to return information held on assets which are not owned by the organization. In such cases, it is necessary to restrict the use of information using other information security controls such as access rights management (5.18) or use of cryptography (8.24).