TL;DR
ISO 27001 asset management is the set of controls that prove you know which devices you own, who holds them, and what happened at the end. For a remote team the hard part is not the policy. It is producing an accurate register, a signed handover and a disposal record for a laptop in another country.
- Seven Annex A controls in the 2022 revision touch employee laptops directly.
- Auditors test your register against reality. They pick names and ask where the device is.
- The usual failure is not a missing policy. It is a register nobody reconciled.
- Leavers, contractors and spare stock are where the gaps show up first.
- You do not need a tool to pass. You need evidence you can reproduce on request.
The moment this becomes real
Say you run People Ops at a 140 person company across nine countries. A customer asks for your ISO 27001 certificate before signing. You have one. Then the auditor asks a simpler question. How many laptops do you own?
You open the spreadsheet. It says 151. Finance says you have bought 168. Eleven people on the list left last year. Two serial numbers appear twice. Nobody can say where the spare machines in the Berlin office went.
Best tools for HR Operations
The certificate was never the problem. The register was. An auditor does not grade your intentions. They sample your list and check whether it is true. The real issue is not whether you have a policy. It is whether anyone has reconciled the list against the world in the last twelve months.
When this is lighter than you think
Not every team needs a project here. Four honest stages.
- Under about 25 devices, in one country. A maintained spreadsheet with serial, holder, purchase date and status is genuinely enough. Auditors accept it when it is accurate.
- You buy everything through one supplier. Your purchase records are already a second source. Reconciling two lists is a morning of work.
- No regulated data on endpoints. If the laptops are thin clients and everything lives in the browser, the device controls get simpler. They do not disappear.
- You are not certified and have no customer asking. Build the register anyway, because it is useful. Skip the control mapping until somebody needs the certificate.
The work becomes real when devices cross borders, when leavers outpace joiners, or when a customer security review lands with a deadline on it.
The five questions teams actually ask
Which Annex A controls apply to laptops? In the 2022 revision, seven are the ones that come up: A.5.9 inventory of assets, A.5.10 acceptable use, A.5.11 return of assets, A.7.9 security of assets off premises, A.7.10 storage media, A.7.14 secure disposal or re use of equipment, and A.8.1 user endpoint devices. Check your own Statement of Applicability, because it governs.
Does the register have to live in a tool? No. The standard asks for an inventory, not for software. A spreadsheet that is accurate beats a tool nobody updates. The question is whether you can show it is current.
How accurate is accurate enough? There is no published threshold. What auditors look for is a reconciliation process with dates on it, and a short list of known exceptions you can explain. A perfect list with no process is weaker than a 96 per cent list with a monthly check.
What counts as proof of disposal? A record tying a serial number to a dated destruction or wipe event, produced by whoever did it. If you cannot connect the certificate to the specific machine, it is paper, not evidence.
Who owns this? Usually nobody, which is the problem. IT owns the devices, People Ops owns the joiners and leavers, Finance owns the purchase record. The register sits between all three and falls over.
Three ways teams cover it, and where each breaks
Keep it in house with a spreadsheet and couriers. Cheapest and most common. It works while one person cares. It breaks when that person leaves, or when a device in Lisbon needs collecting and nobody owns the courier booking. The register drifts quietly, and you only find out during an audit.
Use the device module of an HR or payroll platform. Convenient, because the joiner and leaver data is already there. It tends to record intent rather than outcome. The record says a laptop was requested. It rarely says the machine came back, or what was done to the disk afterwards.
Use a dedicated lifecycle service. The device gets procured, shipped, collected, stored, wiped and disposed of by one party, so the audit trail is produced as a by product rather than reconstructed later. It costs more per device and it introduces a vendor you now have to assess, which is its own Annex A exercise.
Five questions to find your own gaps
Most ISO 27001 asset management gaps are findable in an afternoon. Five questions that surface them faster than a full audit.
Can you produce the register in under an hour? If it takes a week of asking people, the register is not a register. It is an idea.
When did you last reconcile it against purchase records? Two independent sources disagreeing is normal. Never having compared them is the gap.
Pick three leavers from last quarter. Where are their laptops? This is the exact test an auditor runs. Run it on yourself first.
Do you count spare stock? Machines in a cupboard, with a colleague, or at a vendor warehouse are still yours. They are the most commonly missing rows.
Who signs off an exception? If a device is written off, somebody has to say so on a date. Without that, write offs look like losses.
What is actually available
Five honest options, including ours, with where each one struggles.
A maintained spreadsheet. Best for teams under 50 devices in one or two countries. Chosen because it is free and everybody can read it. Struggles the moment two people edit it, and it holds no evidence, only claims.
An IT asset management tool. Best when you have an IT function to run it. Good at discovery on devices that are switched on and enrolled. Struggles with anything off the network: the leaver’s laptop in a drawer is invisible to agent based discovery, which is exactly the device the auditor asks about.
An HR platform device add on. Best when headcount changes are the main driver and volumes are modest. Struggles on physical outcomes, and usually cannot produce a disposal record.
A local ITAD or disposal specialist. Best for the end of life step specifically, and they will give you proper documentation. Struggles on the first nine tenths of the lifecycle, and you still need the device to reach them.
RemoAsset. Best for distributed teams where devices move across borders and the register keeps drifting. Chosen because procurement, delivery, retrieval, storage, wiping and disposal run through one party, so the handover and disposal records exist without anybody assembling them. Where it struggles: it is a service rather than software, so if you want agent based discovery and software licence tracking on live machines, that is a different category of product and you will still want one. It also publishes an entry subscription price but no per device rates, so budgeting means a conversation.
Where to start, by situation
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| One office, low turnover | Under 25 devices | No IT function | Nobody has written the list down | A spreadsheet plus a quarterly count |
| Two or three countries | 25 to 100 | One IT generalist | Leaver devices go missing | Fix the leaver process before buying anything |
| Distributed, hiring fast | 100 to 400 | Small IT team | Register drifts faster than it is corrected | A lifecycle service such as RemoAsset for the physical chain |
| Distributed, certified | 100 to 400 | Security lead in post | Evidence exists but cannot be produced quickly | Map each control to one named artefact |
| Mature IT function | 400 plus | Dedicated ITAM owner | Software and hardware tracked separately | A discovery tool, with disposal handled by a specialist |
What the gap actually costs
The obvious cost is a nonconformity, and that is rarely the expensive part. Minor findings get closed with a corrective action plan. The expensive part is the deal that stalls while you assemble evidence you should already have had.
There is a second cost that nobody puts on a slide. Every hour spent reconstructing where a laptop went is an hour not spent on the work. Teams routinely burn a week of People Ops time before a surveillance audit, every year, recreating a list that could have maintained itself.
The third is the one that matters most. An unreturned laptop with company data on it is a device you cannot attest to. If you cannot say what happened to the disk, you cannot honestly answer a customer who asks. So the question is not whether your register is tidy. It is whether you could stand behind it in front of somebody who will check.
When the spreadsheet stops being enough
The signal that ISO 27001 asset management has outgrown your spreadsheet is not device count. It is the ratio of corrections to entries. When you spend more time fixing the register than adding to it, the process has stopped working and more discipline will not fix it.
What changes with a lifecycle service is where the evidence comes from. Instead of asking a departed employee’s manager what happened to a laptop, the collection, the storage and the wipe are steps somebody else performed and recorded. A laptop lifecycle management service for distributed teams produces the handover and disposal trail as a by product of doing the work.
That is not a reason to buy one. It is a reason to be honest about which of the seven controls you can currently evidence without a scramble, and which you cannot. If the answer is most of them, keep the spreadsheet. If the gaps cluster around return and disposal, those are the two steps worth handing to somebody whose job they are. RemoAsset publishes its approach to device security and data handling if you want to assess it the way you would any processor.
See how device data wiping and disposal records work
Read our guide to equipment compliance evidence
Related reading
- How to write an asset management policy
- Information security policy for a first customer review
- Answering the device section of a security questionnaire
- Choosing IT asset management software
- The standard itself is published by ISO, and the UK NCSC publishes practical device security guidance that maps onto several of these controls.
Frequently Asked Questions
Does ISO 27001 asset management require specific software?
No. The standard asks for an inventory of assets and does not name a product. A spreadsheet is acceptable when it is accurate and someone reconciles it on a schedule you can show. Auditors test whether the list matches reality, not which tool produced it. Most findings come from stale data rather than from the absence of a tool.
Which Annex A controls cover employee laptops?
In the 2022 revision the ones that usually apply are A.5.9 on inventory, A.5.10 on acceptable use, A.5.11 on return of assets, A.7.9 on assets off premises, A.7.10 on storage media, A.7.14 on secure disposal or re use, and A.8.1 on user endpoint devices. Your Statement of Applicability decides which are in scope for you.
How often should we reconcile the asset register?
There is no published frequency. Quarterly suits most distributed teams, with a fuller count once a year before a surveillance audit. What matters more than the interval is that the reconciliation is dated, that exceptions are listed, and that somebody is named as responsible for closing them.
Do contractor devices belong in the register?
If your company owns the device, yes, regardless of the holder’s contract type. If the contractor uses their own machine, the device is out of scope for inventory but your acceptable use and data handling controls still apply. Record which arrangement applies to each person, because this is a common audit question.
What evidence proves a laptop was disposed of properly?
A record that ties a specific serial number to a dated wipe or destruction event, issued by whoever performed it. A generic statement that devices are wiped is not evidence. If you cannot match the paperwork to the individual machine, an auditor will treat the control as unproven.
Can we pass an audit with devices we cannot locate?
Sometimes, if the number is small and you have a documented exception process with write offs approved on a date. What fails is an unexplained gap. Treat missing devices as a known issue with an owner rather than leaving them silently on the list.
Does a lifecycle vendor take on our compliance obligations?
No. You remain accountable for the controls in your scope. A vendor can perform steps and produce records, which makes the evidence easier to hold, but the certificate is yours. You also need to assess that vendor, which is its own supplier control under the standard.
