ISO 27001:2022 Annex A 5.9 Inventory of Information and Other Associated Assets Explained

ISO 27001 Annex A 5.9 is an ISO 27001 control that requires an organisation to develop and maintain an inventory of information and other associated assets.

We cannot control what we do not know so this clause is about understanding our data and the assets that process, store or transmit it.

In this guide you will learn how to implement ISO 27001 Annex A 5.9 Inventory of Information and Other Associated Assets and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.

Purpose & Definition

ISO 27001 Annex A 5.9 is a preventive control that ensures you identify the organisations information and other associated assets in order to preserve their information security and assign appropriate ownership.

The ISO 27001 Standard defines ISO 27001 Annex A 5.9 as:

ISO 27001 Annex A 5.9 Video Tutorial

In this training video you will learn How to implement ISO 27001 Inventory Assets (Annex A 5.9) and Pass Your Audit

Implementation Guide

You are going to have to ensure that

• information and assets are identified
• the importance of information and assets is determined
• information and assets are documented
• documentation is accurate, up to date and consistent
• the location of assets is recorded
• assets are classified
• ownership of assets is allocated when created or transferred to the organisation and reassigned when current owners leave or change role

Topic specific policy on asset management

You are going to implement a topic specific policy on asset management. You can learn more in our Beginner’s Guide to the Asset Management Policy.

Asset Management Policy Template

Data Asset Register

You will implement a Data Asset Register.

Data Asset Register Template

Physical Asset Register

You will implement a Physical Asset Register that will include virtual machines. You can learn more in our Beginner’s Guide to the Physical Asset Register.

Physical Asset Register Template

Return of assets

You will implement a process for the return of assets in line with the guidance in ISO 27001 Annex A 5.11 Return of Assets

Acceptable use of assets

You will implement a process for the acceptable use of assets in line with the guidance in ISO 27001 Annex A 5.10 Acceptable use of information and other associated assets.

What about virtual machines?

The standard has been updated to account for virtual machines. It sets out that the level of detail required should be appropriate of the needs of the organisation.

Sometimes it just isn’t feasible to document instances of virtual machines especially if they are short lived as is the case with some virtual machines that can be short lived and have a short duration. That is ok.

Asset Ownership

Assets need to be assigned an owner. The standard allows for ownership to be individuals or groups. Where possible you should try to identify individuals. This can be either named individuals or the job title of the role. By allocating to an individual it will drive more accountability than assigning to a group of people.

What are asset owners duties?

The asset owner is going to be responsible for the management and protection of the asset over its entire lifecycle. They are going to

• Make sure assets are document and in asset registers
• Ensure assets have the correct classification and protection
• Review assets and set intervals which will include access to the asset and the controls protecting the asset
• Put in place the acceptable use requirements for the asset
• Be responsible for the correct deletion / disposal of the asset and the documentation recording it including removing from asset registers.
• Be part of the risk identification and risk management of the assets

How to implement ISO 27001 Annex A 5.9

Implementing Annex A 5.9 requires a systematic approach to identifying and documenting every asset that supports your Information Security Management System (ISMS). Following these steps ensures that protection levels remain proportionate to the value and risk of each specific asset, satisfying the core requirements of ISO 27001.

1. Define the Asset Taxonomy and Scope

• Identify all categories of assets including hardware, software, information, and outsourced services.
• Establish clear boundaries for what constitutes an asset within the ISMS scope.
• Result: A comprehensive classification framework that ensures no critical data or hardware is overlooked during the inventory process.

2. Assign Formal Asset Ownership

• Designate an individual owner for every identified asset or asset group.
• Define the owner’s responsibilities for classification, access authorisation, and periodic reviews.
• Result: Clear accountability for the protection and maintenance of assets throughout their operational life.

3. Build a Centralised Asset Register

• Create a single source of truth, such as a database or spreadsheet, to host all asset records.
• Ensure the register is accessible to relevant security personnel but protected against unauthorised modification.
• Result: A searchable, managed repository that facilitates rapid incident response and risk assessment.

4. Classify Information and Associated Assets

• Apply classification labels based on the sensitivity and value of the information stored on or processed by the asset.
• Align these labels with your organisational Information Classification Policy.
• Result: The application of security controls that are commensurate with the asset’s importance to the business.

5. Document Technical Metadata and Physical Location

• Record specific technical details including serial numbers, software versions, and physical or logical locations.
• Include cloud service regions for virtual assets to satisfy data residency requirements.
• Result: Granular visibility into the technical environment, enabling better patch management and physical security.

6. Link Assets to IAM Roles and Access Governance

• Map each asset to specific Identity and Access Management (IAM) roles and groups.
• Enforce Multi-Factor Authentication (MFA) for assets containing highly sensitive or “Confidential” information.
• Result: A hardened security posture where access is restricted based on the principle of least privilege.

7. Manage Mobile and Removable Media Assets

• Include laptops, mobile phones, and encrypted USB drives in the inventory.
• Track the issuance of these devices to specific employees or contractors.
• Result: Reduced risk of data loss from portable devices and improved tracking of hardware outside the office.

8. Formalise the Asset Lifecycle and ROE

• Develop a Record of Equipment (ROE) to track assets from procurement to decommissioning.
• Implement secure disposal procedures to ensure all data is wiped before hardware leaves the organisation.
• Result: An auditable trail of asset movement that prevents “ghost” assets from remaining in the register.

9. Map Asset Dependencies to Business Processes

• Identify which business processes rely on specific assets to function.
• Document dependencies between hardware, software, and the data they process.
• Result: Enhanced Business Continuity Planning (BCP) and more accurate Business Impact Analysis (BIA).

10. Schedule Periodic Reconciliations and Audits

• Conduct quarterly or annual physical and logical audits to verify the accuracy of the register.
• Update the inventory immediately following significant changes or infrastructure migrations.
• Result: Continuous compliance with Annex A 5.9 and a reliable foundation for the internal audit process.

How to comply

To comply with ISO 27001 Annex A 5.9 Inventory of information and other associated assets you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:

• Establish and document asset inventories
• Identify, list and document the assets
• Assign owners to assets
• Protect and ensure adequate controls for assets based on risk and classification
• Review asset inventories and access to assets

How to pass the ISO 27001 Annex A 5.9 audit

To pass an audit of ISO 27001 Annex A 5.9 Inventory of information and other associated assets you are going to make sure that you have followed the steps above in how to comply.

What will an audit check?

The audit is going to check a number of areas. Lets go through the main ones

1. That you have an inventory of assets

What this means is that you need to show that you have asset inventories in place. It does not need to be one inventory but every asset must be in an inventory.

2. That you have taken action as a result of asset inventories

Your asset registers and asset inventories are going to be living documents with asset owners documented and assigned and the key controls and required components of the registers recorded. The audit will check that reviews are performed and that access to assets has been performed. It will check the implemented and documented controls that protect those assets.

3. That asset inventory forms part of risk management and operations

Your asset register will factor in and evidence risk management. This could be management of the risks associated with assets or the risks that the assets themselves pose.

Top 3 Mistakes People Make and How to Avoid Them

The top 3 Mistakes People Make For ISO 27001 Annex A 5.9 are

1. Your asset register and asset inventory does not include all assets

Remembering the scope is the scope statement and your ISO 27001 scope it is easy to focus on data assets that relate to data protection and miss the wider data assets. Code repositories are a good example. Focusing on productions assets and not considering development and test. Stating that VMS are not assets or are too hard to manage and document.

2. You do not evidence ownership or actions

Be sure owners are assigned and that actions such as access reviews and asset reviews can be evidenced. Do not overlook end of life processes, destruction of assets or when asset owners leave or change role.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

ISO 27001 Annex A 5.9 FAQ

ISO 27001 Controls and Attribute Values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Confidentiality	Identify	Asset management	Governance and Ecosystem
	Integrity			Protection
	Availability