Introduction:
Information assets have become crucial for organizations. Information technology (IT) equipment and storage media contain valuable information that should be protected against unauthorized access, theft, or loss.
Therefore, it is important to ensure that proper policies and procedures are in place for the removal of such assets from the organization’s premises.
This is where A.11.2.5 Removal of Assets, as part of the ISO 27001 standard, comes into play. In this article, we will discuss the checklist for A.11.2.5 and its importance in ensuring the security of information assets.
Sample Checklist:
- Check the policy and procedure: The organization should have a documented policy and procedure in place for the removal of information assets. The policy should clearly state the requirements and responsibilities for the removal of such assets from the organization’s premises.
- Authorization: There should be a documented authorization process for the removal of IT equipment and storage media. The authorization process should ensure that only authorized personnel can remove assets from the premises.
- Restricted access: Access to areas where information assets are stored should be restricted to authorized personnel only. This includes data centers, server rooms, and storage rooms.
- Tracking movements: The organization should have a process in place to track the movement of high-value or high-risk assets. This includes recording the details of the asset, the reason for its removal, the authorized personnel, and the date and time of removal.
- Walkthrough process: Walkthrough the process of removing an asset from the organization’s premises to ensure that the policy and procedures are being followed correctly. This should include checking the authorization process, restricted access, and tracking movements.
- Sample records: Check a sample of records to ensure that they are accurate and complete. This includes records of assets that have been removed from the organization’s premises.
- Importance:
A.11.2.5 Removal of Assets is important for ensuring the security of information assets. It helps to prevent unauthorized access, theft, or loss of IT equipment and storage media. The policy and procedures should be followed strictly to ensure that only authorized personnel can remove assets from the organization’s premises. Tracking the movement of high-value or high-risk assets is important to ensure that they are not lost or stolen. A walkthrough of the process and checking the records of removed assets can help to identify any weaknesses in the policy and procedures.
Conclusion:
A.11.2.5 Removal of Assets is an important aspect of the ISO 27001 standard that should not be overlooked.
It is important to have proper policies and procedures in place to ensure the security of information assets.
Checking the policy and procedures, authorization, restricted access, tracking movements, walkthrough process, and sample records are crucial steps in ensuring that the policy and procedures are being followed correctly.
By following these steps, organizations can protect their valuable information assets from unauthorized access, theft, or loss.
