Asset Register is a comprehensive inventory of organisational resources required under ISO 27001 Annex A 5.9. The Asset Register establishes a Primary Implementation Requirement for risk management by identifying all data-bearing entities, ultimately providing the Business Benefit of ensuring 100% visibility and security for every critical information asset within scope.
What is an asset register?
An asset register is a detailed list of all valuable things a company owns. Think of it as a master inventory for a business, but instead of just products for sale, it lists everything from computers and software to office buildings and vehicles. This list helps a company keep track of its resources, know their value, and protect them.
Examples
- A software company’s asset register might list every server, laptop, and software license it owns, including the date they were bought, their serial numbers, and their location.
- A manufacturing company’s asset register would include large machinery, tools, and company vehicles, along with details like purchase price and who is responsible for each item.
- A hospital’s asset register would track everything from MRI machines to patient data systems and even medical equipment like stethoscopes.
Context
Having an accurate asset register is vital for a few reasons. It helps with financial reporting, as a company needs to know the value of what it owns. It’s also critical for security. For instance, if a company wants to protect its most important data, the first step is to know which computers or servers hold that data. This is where the asset register comes in—it tells the company exactly what needs to be protected.
The process of creating and maintaining this list is called asset management. It’s a key part of good business practice and a core part of protecting a company’s information and physical property.
How to implement Asset Register
Implementing a robust Asset Register is the fundamental first step in achieving ISO 27001:2022 compliance: it is the primary defensive map of your organisation. By following this structured ten step approach, you satisfy the requirements of Annex A 5.9 and ensure that every information asset is identified, classified, and protected according to its criticality within your Information Security Management System (ISMS).
1. Formalise the Asset Management Policy
Define the high-level rules for asset identification and ownership to establish clear governance. This policy must dictate how assets enter, move through, and leave the organisation.
- Identify the scope of the Asset Management Policy within the ISMS.
- Establish the “Rules of Engagement” (ROE) for asset handling and acceptable use.
- Obtain senior management approval to ensure organisational enforcement.
2. Identify and Document Information Assets
Capture every primary information asset including data sets, intellectual property, and proprietary databases. This ensures that the most valuable “crown jewels” of the business are accounted for first.
- Interview department heads to identify critical data flows.
- Document the format of the information: whether digital, physical, or cloud-hosted.
- Categorise assets as Information, Hardware, Software, People, or Services.
3. Map Technical Hardware and Infrastructure
Create a technical inventory of all physical devices and infrastructure that support your information assets. This mapping provides visibility into the physical points of entry for potential threats.
- Record serial numbers, MAC addresses, and physical locations for all hardware.
- Include mobile devices and remote workstations to prevent “Shadow IT” gaps.
- Provision the list within a centralised Asset Register tool for real-time tracking.
4. Assign Information Asset Owners (IAOs)
Assign a specific individual to every asset to ensure accountability for its security. Without a designated owner, security controls are rarely maintained or enforced over time.
- Designate IAOs who have the authority to make decisions regarding asset access.
- Update job descriptions to include IAO responsibilities for ISO 27001 compliance.
- Record the IAO’s contact details directly against the asset in the register.
5. Categorise and Record Software Assets
Inventory all software, applications, and cloud-based services used to process organisational data. This enables effective patch management and license compliance across the estate.
- List all proprietary and third-party software including version numbers.
- Identify the end-of-life dates for critical applications to plan for secure transitions.
- Link software assets to the hardware they reside on for dependency mapping.
6. Determine Security Classifications
Evaluate and assign a classification level to every asset based on its value and sensitivity. This ensures that security expenditure is prioritised for the most critical data.
- Apply labels: such as Public, Internal, Restricted, or Confidential.
- Define clear handling instructions for each classification level.
- Ensure classification levels are reviewed during the initial risk assessment.
7. Map Data Locations and Technical Dependencies
Document the exact location of assets and the dependencies between them to understand the ripple effect of a potential breach. This is vital for effective business continuity planning.
- Identify where data is stored: including primary servers, backups, and cloud storage providers.
- Map data transfer paths to ensure encryption is applied in transit.
- Document the country of origin for cloud services to meet regulatory requirements.
8. Define Data Retention and Disposal Requirements
Establish clear timelines for how long assets should be kept and the technical requirements for their secure destruction. This reduces the risk of old, unpatched data becoming a liability.
- Create a retention schedule linked directly to the Asset Register entries.
- Define secure disposal methods for physical hardware: such as certified shredding or degaussing.
- Automate deletion triggers for digital data where technically feasible.
9. Provision Access Controls via IAM Roles
Utilise the Asset Register to define who can access specific assets based on their job role. This satisfies the “Need to Know” principle required for ISO 27001.
- Link Identity and Access Management (IAM) roles to specific asset categories.
- Mandate Multi-Factor Authentication (MFA) for all restricted and confidential assets.
- Document the approval workflow for granting new access requests.
10. Audit the Register via Regular Reviews
Schedule periodic audits of the Asset Register to ensure it remains an accurate reflection of the organisation. An out-of-date register is an auditor’s primary target for a major non-conformity.
- Conduct quarterly “Spot Checks” to verify physical asset locations.
- Perform annual full-estate reviews with all Information Asset Owners.
- Formalise the audit findings as evidence for the ISO 27001 External Audit.
Asset Register FAQ
Understanding an asset register is critical for maintaining the integrity of your Information Security Management System (ISMS). Below are the most frequent queries regarding the implementation and management of an asset register under the ISO 27001:2022 standard.
What is an ISO 27001 Asset Register?
An ISO 27001 Asset Register is a comprehensive inventory of all information assets within the scope of your Information Security Management System (ISMS). Defined under Annex A 5.9, it acts as the “single source of truth” for risk management, ensuring 100% accountability for every data set, software, and hardware component in the organisation.
What information must be included in an Asset Register?
To achieve 100% compliance during an ISO 27001 audit, your Asset Register must document the asset name, a clearly assigned owner, and its security classification. Additional mandatory fields typically include:
- Physical or logical location of the asset.
- Asset format (e.g. digital, physical, or cloud-based).
- Disposal and retention requirements.
- Specific technical dependencies or software versions.
Why is the Asset Register critical for ISO 27001 audits?
The Asset Register is critical because it provides the foundation for the entire risk assessment process; without it, auditors cannot verify that controls are applied to all sensitive assets. Approximately 90% of certification failures related to risk management stem from incomplete asset inventories that overlook “Shadow IT” or third-party cloud services.
Who is responsible for maintaining the Asset Register?
While the CISO manages the framework, individual Information Asset Owners are responsible for the day-to-day accuracy of their specific asset entries. ISO 27001:2022 requires that 100% of identified assets are assigned to an owner who understands the asset’s value and ensures it is protected according to its classification.
How often should the ISO 27001 Asset Register be updated?
The Asset Register should be updated continuously, with a formal review conducted at least annually or after significant organisational changes. High-growth firms often perform quarterly reconciliations, which has been shown to reduce undocumented asset risk by up to 45% compared to firms that only review assets during audit preparation.
Relevant ISO 27001 Controls
The following controls from the ISO/IEC 27001:2022 standard are related to the asset register:
- ISO 27001:2022 Annex A 5.9 Inventory Of Information And Other Associated Assets: This control requires an organisation to create and maintain an inventory of all assets associated with information and information processing facilities.
- ISO 27001:2022 Annex A 5.11 Return Of Assets: This controls sets rules for returning assets to the organisation when no longer required.
- ISO 27001:2022 Annex A 5.10 Acceptable Use Of Information And Other Associated Assets: This control requires that rules be established and enforced for the acceptable use of information and assets.
- ISO 27001:2022 Annex A 7.9: Security Of Assets Off-Premises: This control requires controls to be in place when assets are away from the organisation.
The Tools We Use.
100% Audit Success. Zero AI Guesswork.
About the author
