12. Asset management

Mapping to standards and frameworks

Mapping to standards and frameworks

Mapping to standards and frameworks

Mapping to standards and frameworks

Requirement

The relevant entities shall establish, implement and apply procedures which ensure that their assets which are under custody of personnel are deposited, returned or deleted upon termination of employment and shall document the deposit, return and deletion of those assets. Where the deposit, return or deletion of assets is not possible, the relevant entities shall ensure that the assets can no longer access the relevant entities’ network and information systems in accordance with point 12.2.2.

Guidance

• Define procedures to ensure that assets are deposited, returned or irrevocably deleted on termination of employment or contractual relationships.
• Make sure that the procedures clearly identify all assets to be returned, according to the asset inventory (Annex to the regulation, point 12.4.1), which can include (indicative, non-exhaustive list):
  • user endpoint devices, e.g. computers, tablets and phones etc and/or portable storage devices , including vehicles, that can store data locally on the vehicle and/or share data externally by means of telematics. Identify where the user process, transfer or store entity data to determine the scope of user endpoint devices;
  • specialised equipment;
  • authentication hardware (e.g. access cards, mechanical keys, physical tokens and smart cards);
  • physical copies of information.

Examples of evidence

• Documented procedures for the timely return of assets upon termination of employment.
• Logs or records indicating that data on returned assets was deleted according to the procedures.
• Completed exit checklist forms that include asset return and data deletion steps, signed by the departing employee and relevant supervisors.

Tips: guidance

• In cases where employees (and other third parties) use their own personal equipment, follow procedures to ensure that all relevant information is traced and transferred to the entity and securely deleted from the equipment.
• Keep a record of the implementation of the policy (list of employees who have left or contractors whose contracts have ended and list of the assets they returned, including return date).
• Make sure that relevant terms are part of the employment or service contract.
• Communicate the procedures to employees during the induction process and during the exit process.
• Check that there is an employee exit interview process and the return of the assets is linked with it.
• Where the deposit, return or deletion of assets is not possible (indicative, non-exhaustive list):
  • ensure that any credentials associated with the assets are revoked or disabled;
  • isolate the assets by placing them in a separate network segment;
  • use access control lists to restrict access to and from the isolated assets;
  • ensure that only authorised personnel can interact with these assets;
  • configure firewalls to block any traffic to and from the isolated assets;
  • physically or logically disable the network interfaces of the assets;
  • continuously monitor the isolated assets and log any access attempts.

Tips: examples of evidence

• Personnel aware of the procedures.
• Communication materials, such as emails or intranet posts, that remind employees of their obligations upon termination.
• Statements confirming that data was irrevocably deleted, especially for external employees or contractors.
• Documentation of the termination process, including coordination between HR and IT departments.
• Sample checks of lists of employees/contractors and the assets they were assigned and those they returned.

Mapping to standards and frameworks