ISO 27001 Asset Inventory: Identify and Classify Assets
Under ISO 27001:2022, an inventory records the information your organisation needs to protect, its supporting assets, and who is accountable for them. It gives your information security management system (ISMS) a practical foundation for risk decisions.
A device list alone leaves gaps where sensitive information sits in cloud platforms, outsourced services or undocumented processes. Start with your ISMS scope, then follow how information is collected, used, shared and retained.
What ISO 27001 requires, including the updated controls
ISO 27001:2022 places inventory requirements in Annex A.5.9 and information classification in A.5.12. The A.5.9 inventory control covers information and associated assets, including their owners.
Older guidance uses ISO 27001:2013 numbering. A.8.1.1 addressed identifying relevant assets and maintaining an inventory; A.8.1.2 addressed ownership. These requirements are combined in A.5.9.
Use this mapping when updating existing documentation.
ISO 27001:2013 control | Subject | ISO 27001:2022 reference |
|---|---|---|
A.8.1.1 and A.8.1.2 | Inventory and ownership | A.5.9 |
A.8.1.3 | Acceptable use | A.5.10 |
A.8.1.4 | Return of assets | A.5.11 |
A.8.2.1 | Information classification | A.5.12 |
A.8.2.2 | Information labelling | A.5.13 |
A.8.2.3 | Handling of assets | A.5.10 |
A.8.3.1, A.8.3.2 and A.8.3.3 | Removable media, media disposal and physical media transfer | A.7.10 |
The updated structure brings inventory and asset ownership together. Related requirements, including information transfer under A.5.14, still need consideration.
Annex A contains 93 controls across four themes: organisational, people, physical and technological. Control selection follows risk treatment, with applicability and exclusions documented in the Statement of Applicability. The controls aren't a universal checklist applied identically to every organisation.
Identify information assets within your ISMS scope
An information asset is information that has value to your organisation and needs protection. Associated assets support its storage, processing, transmission or protection.
Relevant examples include customer records, employee files, source code, contracts and operating procedures. Supporting assets include Microsoft 365, databases, laptops, servers, networks, backup services and cloud services.
Include outsourced services such as payroll processing and managed IT support. Record the service and link its provider to your supplier register; you don't need to treat the supplier's entire business as an owned asset.
Use a repeatable discovery process:
Start with business processes and ask departments what information they use, where it resides and who receives it.
Reconcile the IT asset register with endpoint-management records, cloud subscriptions, identity-platform applications, procurement records and configuration management databases (CMDBs).
Trace information through sharing, backups, archives and deletion to identify overlooked copies and services.
Investigate unapproved software, legacy systems and personal devices used for work, then assign owners and assess their risks.
Existing IT asset management records can support discovery, but technical scanning won't identify every document collection or outsourced process.
Add an unapproved tool as soon as it handles in-scope information or provides access to it. Its approval status doesn't remove the risk.
Ordinary chairs, desks and computer mice usually don't belong in the register. Assess equipment such as smart displays by its actual capabilities, rather than excluding every screen automatically.
Build a register with accountable owners
A controlled spreadsheet can form part of a proportionate asset management process for a small organisation. Larger environments may need linked inventories or a CMDB, or a link to an existing IT asset register, provided ownership and relationships remain clear and records aren't duplicated.
The following entry illustrates fields for a Microsoft SharePoint Online HR document library.
Register field | Example content |
|---|---|
Unique asset ID and name | Stable identifier; SharePoint HR document library |
Description and asset type | Employee documents; information repository |
Location | Microsoft 365 tenant, site and relevant data region |
Accountable owner | Head of HR |
Custodian | Microsoft 365 administration team |
Classification | Confidential, under the organisation's classification policy |
Access mechanisms | HR security group, MFA and access reviews |
Retention and disposal | Approved HR retention schedule and deletion procedure |
Linked systems and suppliers | Microsoft 365, identity platform and backup service |
Related risks and controls | Unauthorised disclosure; restricted access and monitoring |
Lifecycle status and review date | Active status and recorded owner review |
The record should identify each information asset and its protection requirements. Record credential metadata and ownership, but keep passwords and keys in an approved secrets-management system.
Clear asset ownership makes the asset owner accountable for inventory accuracy, classification, protection requirements, access restrictions and disposal decisions. The custodian implements operational controls, such as permissions, backups and secure deletion.
Assign ownership to someone with authority over the information's business use. IT shouldn't automatically own HR records because it administers the platform.
Protect the register itself. System locations, dependencies and ownership details can reveal sensitive operational information.
Classify information according to business impact
Choose a scheme that fits your organisation
ISO 27001:2022 requires information classification according to security needs, but it doesn't mandate a universal scheme. Your categories should reflect business needs, legal obligations, contractual requirements and the consequences of compromise.
Public, Internal, Confidential and Restricted are possible labels. Define each category with clear criteria and examples. Your asset classification approach is an implementation choice for applying those labels.
Published brochures may be Public, whilst employee records require stronger restrictions. Customer contracts and engineering designs may carry protection obligations imposed by clients.
Record availability and integrity requirements alongside confidentiality. A public website may contain no confidential information but still require strong protection against disruption and unauthorised changes.
Translate labels into handling requirements
Information classification should determine practical rules for access, sharing, storage, labelling, retention and disposal. Labels without handling instructions provide limited protection.
Define which groups can access confidential records, whether external sharing needs approval, and which transfer methods are permitted.
Classify information first, then apply suitable protection to the systems holding it. A shared application may contain several information categories.
Where practical, separate information with different requirements. Otherwise, apply controls appropriate to the most sensitive information held, without ignoring integrity or availability needs.
Owners should review classification when information changes purpose, becomes public or falls under new contractual obligations.
Connect the inventory to information security risk assessment
Identify dependencies and realistic consequences
The inventory provides context for assessing information security risks: what needs protection, where it sits and who understands its business impact.
Treat payroll records as an information asset. They depend on applications, identity services, devices, backups and external processors. Assessing the database alone would miss risks from supplier access or failed recovery.
Map these relationships without duplicating every technical detail. Link supporting records where information already exists. Our guidance on understanding ISO 27001 requirements explains how this work fits the wider management system.
Evaluate risks and select proportionate controls
Classification identifies protection needs; risk assessment evaluates threats, vulnerabilities, likelihood and consequences.
For employee records, consider excessive permissions and unauthorised disclosure. For a production database, consider ransomware, corruption and service interruption. Link each assessed risk to accountable owners, treatment decisions and relevant controls.
Supplier relationships also require attention to access, contractual responsibilities and continuity arrangements. Our guidance on assessing supplier ISO certifications supports supplier assurance alongside those operational assessments.
An accurate ISO 27001 asset inventory supports risk assessment without prescribing one assessment method. Process-based and scenario-based approaches can use the same information.
Keep the inventory current throughout the asset lifecycle
Update records when business changes happen
ISO 27001:2022 control A.5.9 requires organisations to maintain an inventory of information and associated assets.
Set a risk-based review schedule. An annual owner review is a practical baseline, but ISO 27001 doesn't prescribe one universal annual interval.
Update records when applications are introduced, cloud storage changes, suppliers are replaced, ownership transfers or systems are retired. Significant migrations and acquisitions should trigger reconciliation.
Link asset management updates to procurement, change management, and joiner, mover and leaver processes. Automated discovery helps identify differences, but business owners must resolve them.
Keep evidence of reviews and corrections so an auditor can see that maintenance happens between assessments.
Control return of assets, removable media and disposal
Leaver procedures should confirm return of assets, transfer of business information and access removal. Secure erasure must follow authorised retention and preservation decisions.
Raise unreturned company equipment as a security incident under your incident procedure, formerly Annex A.16 and now covered by A.5.24 to A.5.28. Record recovery attempts and protective actions, including access revocation and remote locking where available.
Where removable media, including USB devices, is permitted, assess the risks and encrypt confidential information during transport. Record authorised removable media and disposal evidence.
Retire records only after ownership, data transfer, retention and secure disposal requirements have been addressed.
Key takeaways
Inventory information, supporting technology and relevant services within the ISMS scope.
Give each asset an accountable owner and protection requirements that match its business impact.
Connect discovery and lifecycle changes to risk decisions so records remain useful between audits.
Frequently asked questions
Is an ISO 27001 asset inventory the same as an IT asset register?
An IT register usually focuses on hardware and software. An information asset inventory also covers datasets, document collections, cloud services and relevant outsourced services. Link existing registers rather than creating conflicting copies.
Must every asset have its own individual record?
Use a level of detail that supports ownership and risk decisions. Similar assets can be grouped where their protection requirements match. Separate assets with materially different owners, risks or handling obligations.
Is ISO 27001 mandatory in the UK?
ISO 27001 certification is generally voluntary. A customer contract or procurement process may require it. Certification doesn't replace compliance with applicable law, including UK data protection requirements.
Build an inventory your organisation can maintain
An effective ISO 27001 asset inventory gives your organisation a reliable basis for protection decisions. Clear ownership and lifecycle updates keep that basis useful as systems and services change.
We provide tailored ISO 27001 implementation support, including registers, risk assessment and supporting documentation.
If you would like to find out more information or require any of our services please Contact Us. Complete our contact form to discuss your requirements.
Comments