+12.2 Handling of assets
---+12.2.1 The relevant entities shall establish, implement and apply a policy for the proper handling of …
---+12.2.2 The policy shall: (a) cover the entire life cycle of the assets, including acquisition, use …
---+12.2.3 The relevant entities shall review and, where appropriate, update the policy at planned intervals …

12.2 Handling of assets

Mapping to standards and frameworks

ISO standard 27001:2022A.5.9, A.5.10, A.5.14, A.7.10
NIST Cybersecurity Framework v2.0ID.IM-01
ETSI Standard EN 319 401 V3.1.1REQ-7.3.2-06X, REQ-7.3.3-01X, REQ-7.3.3-02X, REQ-7.3.3-03X
CEN/TS 18026:2024ISP-02, AM-02, AM-03
BE-CyFun®2023BASIC: ID.AM-1.1, ID.AM-3.1, ID.GV-4.1
IMPORTANT: ID.AM-1.2, ID.AM-6.1, ID.RA-6.1, PR.DS-3.2, PR.DS-3.3
FI-KybermittariPROGRAM-2, ASSET-1, ASSET-2, ASSET-5, ARCHITECTURE-5, ARCHITECTURE-6, WORKFORCE-1
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: article 11c
Cybersecurity Handbook: Part B: 1.1, 1.3, 1.6, 1.7, 1.8
Self assessment tool: 2.1, 2.2, 2.4, 2.7, 2.8, 2.9, 2.10
ENS-Royal Decree 311/2022Article 40
Annex II: [op.pl.1] Risk analysis
FR1.1-IE/EE
2.A.3-IE/EE
3.A.1-IE/EE
5.A.1-EE
16.1-EE
16.3-EE

1. Panoramica

12.2.1 The relevant entities shall establish, implement and apply a policy for the proper handling of …

Requirement

The relevant entities shall establish, implement and apply a policy for the proper handling of assets, including information, in accordance with their network and information security policy and shall communicate the policy on proper handling of assets to anyone who uses or handles assets.

Guidance

  • Ensure that employees, direct suppliers, service providers and any other third parties who use or handle the entity’s assets (101) are aware of the policy.
  • Consider mobile devices, such as smartphones and tablets, and determine a strategy for mobile device management, including Bring-Your-Own-Device (BYOD) (102).

Examples of evidence

  • Policy on the proper handling of assets .
  • User manuals or instructions provided to employees, direct suppliers, service providers and any other third parties who use or handles the entity’s assets.
  • Documentation showing that employees have completed training sessions on the asset handling policy.
  • Forms or electronic records that employees, direct suppliers, service providers and third parties have signed to acknowledge they have read and understood the policy.
12.2.2 The policy shall: (a) cover the entire life cycle of the assets, including acquisition, use …

Requirement

The policy shall: (a) cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal; (b) provide instructions on the safe use, safe storage, safe transport and the irretrievable deletion and destruction of the assets; (c) provide that the transfer shall take place in a secure manner, in accordance with the type of asset or information to be transferred.

Guidance

  • Identify, document and implement a policy for handling assets (103) throughout their life cycle (acquisition, use, storage, transportation and disposal).
  • Ensure that the policy includes at least safe storage, safe transport; and irretrievable deletion and destruction. For example:
    • create user manuals and training materials on the correct and secure use of assets;
    • establish guidelines for secure storage, taking into account backup management ( section 4.2);
    • define protocols for secure transfer, including consider secure migration processes, when transferring data to a cloud service;
    • outline methods for data wiping and physical destruction, ensuring complete and irretrievable deletion.
  • Ensure that the policy covers the proper usage of all in-scope assets, both on-premises and off-premises (e.g. mobile devices, data in the cloud, transient data (104) or sensitive information).
  • Ensure that assets may be transferred to external premises only after approval by authorized management bodies, in accordance with the policy.
  • Link the asset handling policy with the asset classification by providing handling details for each classification level.

Examples of evidence

  • Documented policy for handling assets.
  • User access lists, access request forms and approval records.
  • Incident reports related to asset handling (e.g. loss, theft or damage).
12.2.3 The relevant entities shall review and, where appropriate, update the policy at planned intervals …

Requirement

The relevant entities shall review and, where appropriate, update the policy at planned intervals and when significant incidents or significant changes to operations or risks occur.

Guidance

  • Review and update the policy for asset handling at least annually .

Examples of evidence

  • Up-to date policy for asset handling
  • Records of reviews or history of changes.

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is related to 12.2. Handling of assets