A.5.11 Organizational
Return of assets
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (9)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PS-4mostlyaligns with — Both controls require a structured termination process that ensures all organizational assets and information are returned or transferred before personnel depart.
- PS-4mostlycovers — A.5.11's return-of-assets process on employment change/termination directly accounts for the retrieve-all-property bullet in PS-4 and overlaps the credential/authenticator revocation part, but leaves the disable-access timing, exit-interview, and retain-access requirements of PS-4 uncovered.
- AC-2partialaligns with — Both require formal account and access revocation actions as part of the personnel termination workflow to prevent continued use of organizational resources.
- CM-8partialaligns with — Both emphasize maintaining accurate records of issued assets so that all equipment and information can be accounted for and recovered during termination.
- MP-6partialaligns with — Both address the secure removal of organizational information from equipment that is returned, sold, or personally owned by departing personnel.
- MP-6covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
Aligned NIST CSF 2.0 outcomes (18)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- ID.AM-08mostlyaligns with — The ISO control ensures assets are recovered and sanitized at the end of their lifecycle with personnel, directly supporting the CSF requirement to manage hardware, software, services, and data throughout their entire life cycles.
- GV.SC-10partialaligns with — The control’s emphasis on recovering assets and knowledge from departing parties extends supply-chain risk management practices to the post-contract or post-employment phase.
- PR.AA-01partialaligns with — By mandating the return of authentication hardware and credentials when personnel depart, the control helps maintain accurate inventories of identities and credentials under organizational management.
- PR.DS-01partialaligns with — Requiring secure deletion of organizational information from personal or purchased equipment protects the confidentiality and integrity of data-at-rest that is leaving organizational control.
- PR.PS-03partialaligns with — Formal return procedures for hardware at termination constitute a hardware maintenance and removal practice that reduces risk associated with assets leaving the organization.
- GV.SC-10implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- ID.AM-08implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.AA-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.DS-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
- PR.PS-03implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
Related OWASP ASVS 5.0 requirements (4)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Related weaknesses / CWE (5)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-284noneprevents — Formal asset-return procedures ensure that authentication hardware and access tokens are reclaimed, limiting continued unauthorized access after employment ends.
- CWE-1301mitigates — Return-of-assets process can include verification of data removal but does not specify technical completeness.
- CWE-200prevents — Requiring the return of all physical and electronic assets plus secure deletion of organizational data from personal devices reduces the chance that sensitive information remains accessible to departing personnel.
- CWE-552mitigates — By tracing and retrieving all copies of information stored on endpoint and portable devices, the control reduces the likelihood that files remain accessible outside the organization’s security perimeter.
Mitigated MITRE ATT&CK techniques (28)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1052prevents — A.5.11 formalizes return of assets (including portable storage and endpoint devices) on termination and prevents unauthorized copying during the notice period, which stops an insider from using those returned or personal devices for physical exfiltration in the termination scenario, but leaves all other non-termination uses of removable media untouched.
- T1052.001prevents — A.5.11 formalizes return of all physical/electronic assets (including portable storage and endpoint devices) on termination and requires secure deletion of org data from personal/owned equipment, which directly stops an insider from using a retained USB device for exfiltration after notice or exit; it is only partial because the control is scoped to the employment-change/termination event and does not constrain an active insider who has not yet entered the notice period.
- T1078prevents — Collecting authentication hardware such as tokens and smartcards at off-boarding directly removes valid credentials that an adversary could continue to use for unauthorized access.
- T1546.004prevents — A.5.11 formalizes offboarding to return all assets (including endpoint devices, portable storage, authentication hardware) and explicitly prevents unauthorized copying of IP during the notice/termination period; this directly stops an departing insider from modifying ~/.bash_* or ~/.zsh_* dotfiles (or equivalent user-owned shell config in their home directory) to plant persistence, but leaves the /etc/* system-wide files (which require root) and any already-installed modifications by non-terminating users untouched.
- T1552.004prevents — A.5.11 formalizes asset return (including authentication hardware, endpoint devices, and portable storage that may hold private keys) on termination and prevents unauthorized copying during the notice period, which stops some post-compromise or insider searches for keys on departing systems; this is only a minority slice of the technique's full scope across live compromised systems, network devices, and non-termination scenarios.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.