ISO27001 Annex A 5.9 Certification Guide | Inventory of Information and Other Associated Assets

ISO27002:2022 Clause 5.9 Inventory of information and other associated assets

In this article I lay bare the changed ISO27001 control – ISO27001:2022 Annex A 5.9 / ISO27002:2022 Clause 5.9 inventory of information and other associated assets. Exposing the insider trade secrets, giving you the templates that will save you hours of your life and showing you exactly what you need to do to satisfy it for ISO27001 certification. We show you exactly what changed in the ISO27001:2022 update. I am Stuart Barker the ISO27001 Ninja and this is ISO27001 Annex A 5.9

What is ISO27001 Annex A 5.9?

ISO27001 Annex A 5.9 Inventory of information and other associated assets is an ISO27002:2022 control that requires an organisation to develop and maintain an inventory of information and other associated assets.

We cannot control what we do not know so this clause is about understanding our data and the assets that process, store or transmit it.

ISO27001 Annex A 5.9 Definition

The ISO27001 standard defines ISO27001 Annex A 5.9 Inventory of information and other associated assets as:

An inventory of information and other associated assets, including owners, should be developed and maintained.

ISO27001 Annex A 5.9 Inventory of information and other associated assets

ISO27001 Annex A 5.9 Implementation Guide

You are going to have to ensure that:

• information and assets are identified
• the importance of information and assets is determined
• information and assets are documented
• documentation is accurate, up to date and consistent
• the location of assets is recorded
• assets are classified
• ownership of assets is allocated when created or transferred to the organisation and reassigned when current owners leave or change role

What about virtual machines?

The standard has been updated to account for virtual machines. It sets out that the level of detail required should be appropriate of the needs of the organisation.

Sometimes it just isn’t feasible to document instances of virtual machines especially if they are short lived as is the case with some virtual machines that can be short lived and have a short duration. That is ok.

Asset Ownership

Assets need to be assigned an owner. The standard allows for ownership to be individuals or groups. Where possible you should try to identify individuals. This can be either named individuals or the job title of the role. By allocating to an individual it will drive more accountability than assigning to a group of people.

What are asset owners duties?

The asset owner is going to be responsible for the management and protection of the asset over its entire lifecycle. They are going to

• Make sure assets are document and in asset registers
• Ensure assets have the correct classification and protection
• Review assets and set intervals which will include access to the asset and the controls protecting the asset
• Put in place the acceptable use requirements for the asset
• Be responsible for the correct deletion / disposal of the asset and the documentation recording it including removing from asset registers.
• Be part of the risk identification and risk management of the assets

ISO27001 Annex A 5.9 Templates

You can save months of effort with these templates that take 25 years of experience and distill it in a pack of prewritten best practice awesomeness.

How to comply with ISO27001 Annex A 5.9

To comply with ISO27001 Annex A 5.9 Inventory of information and other associated assets you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:

• Establish and document asset inventories
• Identify, list and document the assets
• Assign owners to assets
• Protect and ensure adequate controls for assets based on risk and classification
• Review asset inventories and access to assets

How to pass an audit of ISO27001 Annex A 5.9

To pass an audit of ISO27001 Annex A 5.9 Inventory of information and other associated assets you are going to make sure that you have followed the steps above in how to comply.

You are going to do that by first conducting an internal audit, following the How to Conduct an ISO27001 Internal Audit Guide.

What will an audit check?

The audit is going to check a number of areas. Lets go through the main ones

#1 That you have an inventory of assets

What this means is that you need to show that you have asset inventories in place. It does not need to be one inventory but every asset must be in an inventory.

#2 That you have taken action as a result of asset inventories

Your asset registers and asset inventories are going to be living documents with asset owners documented and assigned and the key controls and required components of the registers recorded. The audit will check that reviews are performed and that access to assets has been performed. It will check the implemented and documented controls that protect those assets.

#3 That asset inventory forms part of risk management and operations

Your asset register will factor in and evidence risk management. This could be management of the risks associated with assets or the risks that the assets themselves pose.

Top 3 ISO27001 Annex A 5.9 Mistakes People Make

The top 3 Mistakes People Make For ISO27001 Annex A 5.9 are

#1 Your asset register and asset inventory does not include all assets

Remembering the scope is the scope statement and your ISO27001 scope it is easy to focus on data assets that relate to data protection and miss the wider data assets. Code repositories are a good example. Focusing on productions assets and not considering development and test. Stating that VMS are not assets or are too hard to manage and document.

#2 You do not evidence ownership or actions

Be sure owners are assigned and that actions such as access reviews and asset reviews can be evidenced. Do not overlook end of life processes, destruction of assets or when asset owners leave or change role.

#3 Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

Why is ISO27001 Annex A 5.9 Important?

The purpose of this control is to identify the organisation’s information and other associated assets in order to preserve their information security and assign appropriate ownership.

It is important because inventories of assets allows is to protect those assets. We cannot protect what we do not know.

With an asset inventory we can support risk management, recovery planning and business continuity. Incident management, patch management, end point and antivirus management are all reliant on asset inventories. It may be that they are also required for other purposes. Those purposes could be financial, insurance, health and safety.

ISO27001 Annex A 5.9 FAQ

Matrix of controls and attribute values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
#Preventive	#Confidentiality #Integrity #Availability	#Identify	#Asset_management	#Governance_and_Ecosystem #Protection

See Also

• Guaranteed ISO 27001 Certification up to 10x Faster and 30x Cheaper
• The Ultimate ISO 27001 TOOLKIT so you can do it yourself 
• ISO 27001 Exposed: The facts you must know (Not knowing these could cost you $10,000s!) 
• 25 Things You Must Know Before Going for ISO 27001 Certification (Number 3 will blow your mind!)
• The Ultimate Reference Guide to ISO 27001 Controls

Reference

ISO/IEC 27001 Information Security Management