ISO 27001 Asset Management Policy: Ultimate Guide

In this guide, you will learn what an ISO 27001 Asset Management Policy is, how to write it yourself and I give you a template you can download and use right away.

What is an ISO27001 Asset Management Policy?

The ISO 27001 Asset Management Policy sets out the guidelines and framework for how identify, protect and manage assets. It covers the entire lifecycle from acquiring the asset, using the asset to ultimately destroying the asst. It ensures the correct assets are identified and protected. We cannot protect what we do not know.

Asset management is one of the most time consuming activities that you will undertake. The asset management policy sets out what the company does when it comes to asset management. It is your blue print for the asset management life cycle.

What is the Purpose of the ISO27001 Asset Management Policy?

The purpose of the ISO 27001 Asset Management Policy is to ensure the integrity of operational systems and prevent exploitation of technical vulnerabilities.

All assets are identified, classified and protected throughout their lifecycle from creation / acquisition through to destruction. The principle is that we cannot protect what we do not know.

How does the ISO27001 asset management policy work?

When it comes to cyber security, you cannot protect what you do not know. Having an understanding of what you have, what computers, what data, what mobiles is fundamental in ensuring you have the right protection in place to protect them. 

An  ISO27001 Asset Management Policy will set out what you do for managing those assets.

ISO 27001 Asset Management Policy Template

Asset Management Policy Example

Here is an example of an asset management policy:

Asset Management Lifecycle 

The asset management lifecycle is concerned with how you acquire, or purchase, assets. Then how you deploy them. It covers how you transport them, how you record them, how you allocate them, how you return them, how you reissue them and ultimately how you destroy them. The policy should cover all of these steps.

It seems simple. Just write down all the devices that you have. It is that simple but I am never surprised when even companies of less than 10 people struggle to know what they actually have.

Your asset management policy will cover every device that can store, process and transmit data. We are looking at the easy things like laptops, tablet, phones but we are also looking at switches and routers. Perhaps printers with memory. Perhaps removable storage. Can it store, process or transmit data? If the answer is yes, it is covered by the policy.

What should ISO27001 Asset Management Policy Contain?

Information and information processing, storing and transmitting devices are identified and an inventory of these assets is drawn up and maintained. Ownership of assets is identified, agreed and documented along with roles and responsibilities. The acceptable use of assets is covered as is the return of assets. The use of asset registers is included. The following is the content structure for the policy:

• Document Contents Page
• Document Version Control
• Document Contents Page
• Asset Management Policy
• Purpose
• Scope
• Principle
• Inventory of Physical and Virtual Assets
• Inventory of Data Assets
• Inventory of Software Licence Assets
• Ownership of Assets
• Acceptable use of assets
• Return of Assets
• Policy Compliance
• Compliance Measurement
• Exceptions
• Non-Compliance
• Continual Improvement
• Areas of the ISO27001 Standard Addressed

How to write an asset management policy

To write an ISO 27001 Asset Management Policy, you must define the technical scope of information assets, assign individual ownership, and establish a formal classification scheme. This process ensures compliance with ISO 27001 Annex A 5.9 by documenting the entire asset lifecycle.

1. Define Asset Scope and Purpose

Document what an asset is for your business. Write a scope that encompasses all physical hardware (servers, laptops), virtual resources (cloud instances, databases), and intangible intellectual property (patents, software code). Clearly state that the purpose of the policy is the identification and managed protection of these assets across all business functions.

2. Assign Ownership and Individual Accountability

Assign every asset to a specific individual, job role, or team. Asset owners are technically accountable for ensuring assets are inventoried, classified, and handled in accordance with the Information Classification Policy. While routine tasks may be delegated, the formal responsibility for the asset’s security remains with the designated owner.

3. Create an Inventory of Physical and Virtual Assets

Put in place a documented inventory for all processing devices. For every item, record the asset name, owner, and importance. For physical hardware, you must additionally add fields for asset numbers, serial numbers, current usage status, and the date of the last technical health check to satisfy audit requirements for physical security.

4. Implement a Data Asset Register

Identify and record all data assets within a dedicated Information Asset Register (IAR). Have fields for the name of the data controller, categories of data subjects, and data retention periods. For high-rigour compliance, include technical details such as international transfer status, lawful basis for processing (GDPR), and the volume of data processed.

5. Manage Software and Licences

Put in place a sub-inventory specifically for software versions and licences. Record whether the software is free or paid, the number of licences purchased versus used, and the precise deployment location. This ensures the organisation avoids legal risks associated with unlicensed software and maintains an accurate Software Bill of Materials (SBOM).

6. Establish Classification and Handling Schemes

Formalise a classification scheme (e.g., Public, Internal, Confidential) based on the asset’s importance to the business. Describe technical handling requirements for each level, such as mandatory full-disk encryption for “Confidential” data, to ensure that protection rigour scales with the level of risk identified.

7. Formalise the Asset Return and Disposal Lifecycle

Put in place strict protocols for the return of organisational assets upon termination of employment or contracts. Implement technical procedures to ensure that if personal equipment was used, all company data is securely erased. During notice periods, execute controls to prevent unauthorised copying of company information by departing users.

8. Approve the Policy

Formalise the policy with a Document Version Control table and a comprehensive contents page. Submit the completed Asset Management Policy to a senior leader or the CISO for formal review and sign-off. This approval provides the governance mandate required to enforce compliance across the organisation.

BYOD

To implement BYOD technical controls within an ISO 27001 framework, you must formalise a registration process, enforce Mobile Device Management (MDM) enrolment, and provision technical containerisation. This ensures that 100% of corporate data remains secured and wipeable without compromising employee privacy on personal hardware, satisfying the high-rigour demands of Annex A 7.9 and 8.1.

1. Formalise Device Registration and User Agreements

Provision a formal registration workflow where employees must declare personal devices used for business. Execute a signed BYOD Agreement that grants the organisation the technical right to manage corporate data on the device, ensuring a clear legal and technical mandate for security enforcement.

2. Enforce Mandatory MDM Enrollment

Execute a technical policy that mandates Mobile Device Management (MDM) enrollment for any device accessing corporate resources. Provision “Compliance Check” gates that block access to email or SaaS tools if the device is jailbroken, lacks a PIN, or has outdated firmware.

3. Provision Technical Data Containerisation

Implement technical containerisation (e.g., Work Profiles or Managed Apps) to create a logical partition between personal and corporate data. This ensures that the organisation can apply strict IAM roles and encryption to business data while remaining technically unable to access the user’s personal photos or messages.

4. Automate Selective Remote Wipe Protocols

Formalise an automated workflow for selective remote wipes. Provision the technical capability to delete 100% of corporate data from a personal device immediately upon an employee’s termination or if the device is reported lost, ensuring zero data leakage without affecting the user’s personal files.

List of relevant ISO 27001 controls

The ISO 27001 standard has specific controls that relate to asset management. Here are a few key ones:

ISO 27001:2022 Control	Implementation Objective & Linkage
Annex A 5.9	Inventory of information and other associated assets: Identification and documentation of all technical resources to ensure 100% visibility of the ISMS perimeter.
Annex A 5.10	Acceptable use of information and other associated assets: Formalisation of rules and technical handling protocols for all staff and third-party users.
Annex A 5.11	Return of assets: Managed decommissioning and technical recovery of hardware and data sets upon termination of employment or contracts.
Annex A 7.9	Security of assets off-premises: Technical protection and physical security requirements for organisational assets used in remote or mobile environments.

FAQ