ISO-27001-Annex : A.8.1.3-Acceptable-Use-of-Assets-&-A.8.1.4-Return-of-Assets

ISO 27001 Annex : A.8.1.3 Acceptable Use of Assets & A.8.1.4 Return of Assets

ISO 27001 Annex : A.8.1.3 Acceptable Use of Assets & A.8.1.4 Return of Assets this is a part of assets management previous article was based on same which is continue in this article.

A.8.1.3 Acceptable Use of Assets

Control- Rules should be identified, documented, and implemented for the acceptable use of information and assets linked to information and information processing facilities.

Implementation Guidance- The information security requirements of the organization’s assets along with information and information processing facilities and resources should be made aware to employees and external users who use or have access to the company ‘s assets. They will be responsible for their use and all other usage carried out on their own responsibility, of any information processing services.

Related Product : ISO 27001 Lead Auditor Training And Certification ISMS

A.8.1.4 Return of Assets

Control- Both workers and external stakeholders must return all of the organizational assets in their possession upon termination of their job, contract or agreement

Implementation Guidance- The termination process must be legally concluded with the return of all tangible and electronic assets previously assigned owned or entrusted to the organization.

When an employee or external user buys the equipment of the company or uses his / her own personal equipment, it is important to follow protocols to ensure that all relevant information is transmitted to the company and safely removed from the equipment.

In situations where an employee or external user is aware that this information is necessary for ongoing operations, it should be reported and transmitted to the organization. During the notice period of termination, unauthorized copying of sensitive information ( e.g. intellectual property) by terminated workers and contractors should be monitored by the company.

At Infosavvy we have our trainers as our assets who are skilled and well-trained in various courses in the field of information security and we are also eligible for one of the most important certificates in the area of information security. i.e. IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification) . Our trainers can empower you to do better asset management by providing you with in-depth information and numerous examples for the same, helping the applicant to improve their skills and do well.

Also Read : ISO 27001 Annex : A.8 Asset Management

Questions related to this topic
  1. What is the formula for return on assets?
  2. What does return on assets mean?
  3. What is a good ROA and ROE?
  4. What is information asset as per ISO 27001?
  5. Explain ISO 27001 Annex : A.8.1.3 Acceptable Use of Assets & A.8.1.4 Return of Assets?

ISO 27001 Requirements

Clause 4.2 Understanding the needs and expectations of interested parties 
Clause 4.4 Information security management system
Clause 4.3 Determining the scope of the information security management system
Clause 5.1 Leadership and commitment
Clause 5.2 Policy
Clause 5.3 Organizational roles, responsibilities and authorities 
Clause 6.1 Actions to address risks and opportunities
Clause 6.1.2 Information security risk assessment process
Clause 6.1.3 Information security risk treatment
Clause 6.2 Information security objectives & planning
Clause 7.1 Resources
Clause 7.2 Competence
Clause 7.3 Awareness
Clause 7.4 Communication
Clause 7.5 Documented information Implementation Guideline
Clause 8.1 Operational planning & control
Clause 8.2 Information security risk assessment
Clause 8.3 Information security risk treatment
Clause 9.1 Performance evaluation Monitoring, measurement, analysis & evaluation
Clause 9.2 Internal audit
Clause 9.3 Management review
Clause 10.1 Non conformity and corrective action
Clause 10.2 Continual Improvement 

ISO 27001 Annex A Controls

Annex A.5 Information Security Policies
Annex A.6 Organization of Information Security
Annex A.6.2 Mobile Devices and Teleworking
Annex A.7 Human Resource Security
Annex A.7.2 During Employment
Annex A.7.3 Termination and Change of Employment
Annex A.8 Asset Management
Annex A.8.2 Information Classification
Annex A.8.2.2 Labeling of Information & A.8.2.3 Handling of Assets
Annex A.8.3 Media Handling
Annex A.9 Access Control
Annex A.9.1.2 Access to Networks and Network Services
Annex A.9.2 User Access Management
Annex A.9.2.3 Management of Privileged Access Rights  
Annex A.9.2.4 Management of Secret Authentication Information of Users
Annex A.9.2.5 Review of User Access Rights 
Annex A.9.2.6 Removal or Adjustment of Access Rights
Annex A.9.3 User Responsibilities
Annex A.9.4 System and Application Access Control
Annex A.9.4.4 Use of Privileged Utility Programs 
Annex A.9.4.5 Access Control to Program Source Code
Annex A.10 Cryptography
Annex A.11 Physical and Environmental Security
Annex A.11.2 Equipment
Annex A.11.1.3 Securing Offices, Rooms and Facilities
Annex A.11.1.4 Protecting Against External and Environmental Threats
Annex A.11.1.5 Working in Secure Areas
Annex A.11.1.6 Delivery and Loading Areas

About ISO 27002

Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us –

Leave a Comment

Your email address will not be published. Required fields are marked *