Community Library

ISO 27001 Travel Checklist

What to do before a trip, while you are away, and when you get back.

Join to save this for later.

A trip takes company information outside the office. Give this list to the traveler. Each step also names the proof your ISO/IEC 27001 program should already be able to show.

How to use this checklist

Hand this to anyone who travels with company information. Work the parts in order: before you leave, while you are away, when you return, and if something goes wrong.
The Proof line is the record your program keeps. If you cannot produce it, the task is not done.
References point to ISO/IEC 27001:2022 Annex A controls, for example A.7.9.

6Before you leave
7While you are away
4When you return
4If something goes wrong

21 tasks for a trip. Each one names the proof to keep and the ISO/IEC 27001:2022 control it supports.

0 of 21 complete

Before · Before you go

Before you leave

Leave with an approved device, a current copy of your work, and a way to report a problem the same day.

0 of 6

Take a company-approved device. Do company work on that device, not on a personal one.
Proof: The traveler is on the approved endpoint list, or the exception is recorded.
A.8.1
Confirm the device is current before it leaves: updates are installed, malware protection is running, and the screen locks on its own.
Proof: Endpoint status dated before the trip.
A.8.1, A.8.7, A.8.8
Know which information may travel with you, and which must stay behind.
Proof: Classification rules the traveler has acknowledged.
A.5.12, A.5.10
Use a sign-in the company can reset. Do not keep the only copy of a password in a note, an email, or an unlocked browser.
Proof: Acceptable use acknowledgment covering authentication information.
A.5.17, A.8.5
Save company work to the company location so the laptop is not the only copy.
Proof: The backup or storage location named in the program.
A.8.13
Carry the way to report a lost device the same day: who to call, and what to say.
Proof: Incident contact in the travel guidance or the incident procedure.
A.5.24, A.6.8

Away · On the trip

While you are away

Keep the device with you, lock it when you step away, and use the company path for network and files.

0 of 7

Keep the device with you. Do not leave it in a car, an unattended bag, or a room you are not in.
Proof: Off-premises rule in the guidance the traveler was given.
A.7.9
Lock the screen whenever you step away, including at an airport, a client site, or a hotel desk.
Proof: Clear screen rule and the traveler's acknowledgment.
A.7.7
Use the company way onto the network. Do not do company work on a network you do not know.
Proof: Remote working rule for networks away from the office.
A.6.7, A.8.21
Do not hand the device to anyone else, including family, hotel staff, or a client.
Proof: Acceptable use rule the traveler has acknowledged.
A.5.10, A.5.15
Do not read sensitive information where another person, a camera, or a line of people can see it.
Proof: Clear screen rule applied away from the office.
A.7.7, A.5.12
Do not plug into an unknown charger, USB stick, or kiosk, and do not install an app just to join a meeting.
Proof: Endpoint rule for untrusted media and software.
A.8.1, A.7.10
Report a strange sign-in, a missing device, or a request to skip a control the same day.
Proof: Event report with the date and the person who reported it.
A.6.8, A.5.24

Return · Back at work

When you return

Bring the device back onto the company build, and put copies and media back where the program expects them.

0 of 4

Reconnect the device and let it catch up: updates, malware protection, and the company build.
Proof: Endpoint status dated after the return.
A.8.1, A.8.8
If the device was out of your sight, say so, and reset the access your program requires.
Proof: Access change, or a note that no gap was reported.
A.5.17, A.5.18
Remove copies you no longer need, including downloads and photos of whiteboards or badges.
Proof: The deletion rule the traveler followed, or a record that the copies were removed.
A.8.10, A.5.10
Put paper and removable media back in the controlled place, or dispose of them the approved way.
Proof: Media back in the register, or a disposal record.
A.7.10, A.7.14

If lost · The same day

If something goes wrong

A lost or tampered device is an incident. Report it, cut off its access, and keep what the investigation needs.

0 of 4

Report a lost, stolen, or tampered device as soon as you know, including where you last had it.
Proof: Incident record opened the same day.
A.5.24, A.6.8
The company removes that device's access and checks what it could reach.
Proof: Access removal record tied to the incident.
A.5.18, A.8.1
Keep the device and the messages. Do not wipe them until the person who handles incidents says so.
Proof: Evidence note on the incident.
A.5.28
Name the information that was on the device, tell the people who need to know, and record what will change before the next trip.
Proof: Incident update, and the lesson recorded for the next trip.
A.5.26, A.5.27

Want this running in the program, not only on paper?

Trygg keeps the owner, the rule, and the proof in one place, so a trip does not start a search.

Book a demo ISO 27001 Preparation Checklist

Portal demos follow a mutual NDA.

This checklist is guidance, not a substitute for the ISO/IEC 27001:2022 standard. Purchase the standard from ISO or your national standards body. Certification decisions are made only by accredited certification bodies.