Inventory of information and other associated assets
Purpose
Identify the organisation's information and associated assets so they can be protected and given proper ownership.
How to meet this control
In short: Develop and maintain an inventory of information and associated assets, with owners.
- Step 01Stand up a single asset register (a CMDB, spreadsheet or GRC module) covering information assets, systems, data stores, devices and SaaS applications
- Step 02Assign a named owner and a classification to every asset and require owners to confirm details during periodic reviews
- Step 03Integrate automated discovery (endpoint management, cloud inventory, SaaS discovery) so the register reflects reality rather than a point-in-time snapshot
- Step 04Tie asset creation and retirement to change and procurement processes and to the joiner-mover-leaver workflow
- Step 05Reassign ownership immediately when an owner changes role or leaves, as part of offboarding
Tip: A single asset register (systems, data stores, devices) with owners is the backbone of many controls.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Identify information and associated assets and judge their importance for security
- ›Keep an accurate, current inventory, which can be a set of dynamic inventories rather than one list
- ›Record asset locations where appropriate and include relevant details
- ›Assign an owner (individual or group) to each asset and identify its classification
- ›Reassign ownership promptly when owners leave or change roles
- ›Have owners ensure assets are inventoried, classified, protected and reviewed periodically
- ›Link technology assets to their supporting components such as databases and software
- ›Ensure assets are securely handled and removed from the inventory when disposed of
Audit evidence to keep
- - Current asset inventory listing information and associated assets with assigned owners
- - Classification recorded against each asset in the register
- - Evidence of periodic asset review and owner confirmation
- - Records showing assets are added on acquisition and removed on disposal
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.5.9. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.