There’s no such thing as a closed IT environment anymore—not in Sri Lanka, not anywhere. With hybrid work normalized, company data now moves fluidly between personal laptops, home Wi-Fi, shared devices, and office terminals. It’s a productivity dream for employees. For CISOs, audit teams, and compliance leads, it’s a nightmare.
In practice, most organisations today don’t have an accurate inventory of the devices that hold or transmit sensitive information, because the perimeter no longer exists. A design team collaborates on a tablet borrowed from home. A support agent logs into a SaaS dashboard using a personal smartphone. An external consultant gets access to client data—without ever being issued a device by IT.
Who owns the asset? What data does it touch? Who’s responsible for wiping it if it’s lost? In the old world, those questions had clear answers. In a BYOD environment, they often don’t.
And that’s precisely where ISO 27001:2022 brings structure.
The New Clause That Changed the Game
ISO 27001 Clause 5.9 and 5.10—two of the most overlooked additions in the updated standard—require organisations to keep a live inventory of all information assets, and to enforce acceptable use for any asset that processes company data.
These clauses don’t just apply to office-issued hardware. They include contractor laptops, mobile phones with MFA apps, employee tablets used for Zoom calls, and even shared workstations used by shift teams.
ISO 27001 doesn’t say “control all devices.” It says: identify what’s in use, who owns it, what data it handles, and how it’s governed. Then prove that your policies aren’t just written—they’re actually working.
In theory, it’s manageable. In reality, it’s where most Sri Lankan businesses fail.
The Costs of Incomplete Inventories
Consider this: PDPA enforcement is on the horizon. The authority can demand—on short notice—evidence of what personal data resides on what device. Without a clean asset register, that request becomes a scramble. For some companies, it becomes the start of a public incident.
For others, the cost is financial. Cyber-insurance underwriters increasingly use asset governance as a risk factor. Miss a single endpoint and you might see exclusions, premium hikes, or a lower payout ceiling. Even enterprise clients are asking more questions in RFPs. They want to know that endpoint security isn’t theoretical. They want proof that device risks are monitored and controlled—not brushed aside with a vague MDM policy.
This Isn’t Just an IT Job Anymore
In a remote or hybrid setup, asset visibility is no longer something that sits in a single dashboard. It cuts across HR (who issues what to whom), legal (who signs off on BYOD terms), security (who tracks endpoint behaviour), and operations (who reacts when a device goes missing).
If that coordination breaks down, your ISO 27001 audit isn’t just delayed—it’s dead on arrival.
The fix isn’t to install more tools. It’s to create a culture where every endpoint is accounted for, every risk is owned, and every policy gets lived—not shelved.
That’s where Ascent Associates role begins.
A Practical, Grounded Approach to Asset Governance
At Ascent Associates, we bring structure to the sprawl using a focused, field-tested process designed for businesses operating in complex environments, like Sri Lanka’s hybrid and BYOD-driven workplaces.
Certification Process – Ascent Associates 3-Step Approach
Evaluate & Plan
We deep dive into your daily operations—alongside your team, through incident logs, and across departments—to pinpoint exactly where controls break down. Whether it’s unmanaged personal devices, outdated MDM policies, or language mismatches in SOPs, we identify the root risks and map them against ISO 27001 clause requirements.
Document, Implement & Train
Next, we convert that plan into live practice. We develop clear documentation, deploy simple, enforceable policies, and run bilingual hands-on training sessions—so your engineers, ops teams, and even field staff understand what’s changing and why. These aren’t just shelf-ready documents. They become daily routines tied into tools your team already uses.
Audit, Certify & Maintain
We handle the evidence management, guide you through external audits, and ensure nothing gets lost in translation during the assessment. Post-certification, we stay with you—monitoring asset registers, reviewing logs, and helping you maintain system integrity, so future surveillance audits feel like regular reviews, not fire drills.
Following these 3 steps with Ascent Associates will secure your ISO certificate on time, with confidence in both the audit and your day-to-day operations.
None of this is theory. We’ve worked with banks, exporters, and mid-sized service firms who initially thought BYOD was “not really a risk,” only to realise later that uncontrolled endpoints were where everything unraveled.
What Comes Next
Remote work isn’t going away. Neither is the regulator’s expectation that you know—and control—where your data lives.
ISO 27001 gives you a defensible structure. But it needs to be translated into the realities of BYOD environments in Sri Lanka: language diversity, device turnover, bandwidth constraints, shared logins, and more.
That’s what we do best. If you’re unsure whether your asset register could survive scrutiny, we’ll show you. In fifteen minutes, we’ll overlay your existing inventory controls against ISO’s 2022 clauses and flag the gaps—with no fluff, no hard sell.
FAQs
Does ISO 27001 actually cover personal (BYOD) devices?
Yes — Clause 5.9 requires every asset that handles company data, even an employee’s phone, to be listed, owned, and controlled.
What’s the single biggest audit fail on BYOD?
Missing evidence that lost or stolen devices can be remote-wiped and logged within set time limits.
How often must the asset register be updated?
Best practice under ISO 27001: review quarterly; update instantly when a new device joins or leaves.
Do we need an MDM tool to pass Clause 5.9?
No, but you must prove equivalent control — enrolment, patching, and wipe authority—regardless of tool choice.
Will token-based SaaS access exempt a laptop from the inventory?
No. If the device can read or cache company data, it belongs in the register—tokenised or not.
