#iso27002/2022/EN

## 5.9 Inventory of information and other associated assets

| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|--------------|----------------------------------------|-----------------------|-------------------------|-----------------------------------|
| #Preventive | #Confidentiality #Integrity #Availability | #Identify | #Asset_management | #Governance_and_Ecosystem #Protection |

**Control**
An inventory of information and other associated assets, including owners, should be developed and maintained.

**Purpose**
To identify the organization’s information and other associated assets in order to preserve their information security and assign appropriate ownership.

**Guidance**

<u>Inventory</u>
The organization should identify its information and other associated assets and determine their importance in terms of information security. Documentation should be maintained in dedicated or existing inventories as appropriate.

The inventory of information and other associated assets should be accurate, up to date, consistent and aligned with other inventories. Options for ensuring accuracy of an inventory of information and other associated assets include:

  a\) conducting regular reviews of identified information and other associated assets against the asset inventory;

  b\) automatically enforcing an inventory update in the process of installing, changing or removing an asset.

The location of an asset should be included in the inventory as appropriate.

The inventory does not need to be a single list of information and other associated assets. Considering that the inventory should be maintained by the relevant functions, it can be seen as a set of dynamic inventories, such as inventories for information assets, hardware, software, virtual machines (VMs), facilities, personnel, competence, capabilities and records.

Each asset should be classified in accordance with the classification of the information (see [5.12](a-5.12-Classification-of-information.md)) associated to that asset.

The granularity of the inventory of information and other associated assets should be at a level appropriate for the needs of the organization. Sometimes specific instances of assets in the information life cycle are not feasible to be documented due to the nature of the asset. An example of a short-lived asset is a VM instance whose life cycle can be of short duration.

<u>Ownership</u>
For the identified information and other associated assets, ownership of the asset should be assigned to an individual or a group and the classification should be identified (see [5.12](a-5.12-Classification-of-information.md), [5.13](a-5.13-Labelling-of-information.md)). A process to ensure timely assignment of asset ownership should be implemented. Ownership should be assigned when assets are created or when assets are transferred to the organization. Asset ownership should be reassigned as necessary when current asset owners leave or change job roles.

<u>Owner duties</u>
The asset owner should be responsible for the proper management of an asset over the whole asset life cycle, ensuring that:

a\) information and other associated assets are inventoried;

b\) information and other associated assets are appropriately classified and protected;

c\) the classification is reviewed periodically;

d\) components supporting technology assets are listed and linked, such as database, storage, software components and sub-components;

e\) requirements for the acceptable use of information and other associated assets (see [5.10](a-5.10-Acceptable-use-of-information-and-other-associated-assets.md)) are established;

f\) access restrictions correspond with the classification and that they are effective and are reviewed periodically;

g\) information and other associated assets, when deleted or disposed, are handled in a secure manner and removed from the inventory;

h\) they are involved in the identification and management of risks associated with their asset(s);

i\) they support personnel who have the roles and responsibilities of managing their information.

**Other information**
Inventories of information and other associated assets are often necessary to ensure the effective protection of information and can be required for other purposes, such as health and safety, insurance or financial reasons. Inventories of information and other associated assets also support risk management, audit activities, vulnerability management, incident response and recovery planning.

Tasks and responsibilities can be delegated (e.g. to a custodian looking after the assets on a daily basis), but the person or group who delegated them remains accountable.

  

It can be useful to designate groups of information and other associated assets which act together to provide a particular service. In this case, the owner of this service is accountable for the delivery of the service, including the operation of its assets.

  

See ISO/IEC 19770-1 for additional information on information technology (IT) asset management. See ISO 55001 for additional information on asset management.