ISO 27001 A.5.9 - Inventory of Information and Other Associated Assets

Requirement

“An inventory of information and other associated assets, including owners, shall be developed and maintained.”

Plain-language meaning

The organization must know what information and related assets it has, where they are, who owns them, how important they are, and how they are protected.

You cannot protect, classify, back up, retain, dispose of, or risk-assess assets you do not know exist.

Why this matters

Asset inventories are the base layer for risk assessment, classification, access control, backup, disaster recovery, retention, disposal, supplier assurance, and audit evidence.

This control is broader than a laptop spreadsheet. It includes information and associated assets such as:

• databases and data sets;
• paper records;
• applications and software;
• servers and endpoints;
• virtual assets and cloud services;
• removable media;
• contracts and system documentation;
• procedures and recovery plans;
• business processes and services;
• systems that store, process, or transmit information.

The inventory should be detailed enough to support Risk Assessment and control decisions. Too much detail becomes unmaintainable; too little detail becomes useless.

Asset ownership

Each important asset needs an owner.

The asset owner is accountable for the asset and its protection. The owner does not have to operate the asset daily, but they must ensure the asset is classified, protected, reviewed, and represented in risk decisions.

Typical asset owner responsibilities:

• determine or approve classification;
• explain business value and criticality;
• support risk assessments;
• ensure appropriate protection;
• approve access or usage rules where relevant;
• keep classification and control expectations current;
• confirm custodians are performing day-to-day protection tasks.

Owner vs custodian

Delegation to a custodian does not remove owner accountability. If the custodian fails, the owner still needs to demonstrate oversight.

Implementation guidance

1. Define inventory scope

The inventory should include major information and associated assets that require protection or support the ISMS.

Include:

• information assets in technical and non-technical formats;
• physical equipment;
• virtual infrastructure;
• software products and licenses;
• cloud services;
• business services and key processes;
• documentation and contracts;
• backup and recovery dependencies;
• retained records that may be liabilities, such as identity documents.

2. Choose the right level of granularity

The inventory does not need to list every file if grouping by business purpose is more useful.

Examples:

The test is simple: can the inventory support risk assessment, ownership, classification, protection, backup, recovery, retention, and disposal?

3. Record the required fields

Useful inventory fields include:

4. Maintain the inventory through change

The inventory must be updated when assets are introduced, changed, moved, reassigned, retired, or disposed of.

Trigger points:

• project initiation and closure;
• change management;
• procurement;
• software deployment;
• cloud service onboarding;
• supplier onboarding or exit;
• data migration;
• business process change;
• asset disposal;
• annual stock check.

This connects directly to A.5.8 Information Security in Project Management.

5. Protect the inventory itself

The asset inventory is sensitive. It can show attackers what systems exist, where data is stored, which systems are critical, and who owns them.

Protect it with:

• access control;
• backup;
• integrity protection;
• change history;
• restricted exports;
• periodic review;
• secure handling of old copies.

Audit guidance

Auditors should confirm that the inventory exists, is complete enough for the organization’s context, is maintained, and includes assigned owners.

Audit work should test:

• whether major information and associated assets are included;
• whether assets are classified;
• whether owners and custodians are assigned;
• whether owners understand their responsibilities;
• whether inventory updates are linked to project and change processes;
• whether disposals are recorded;
• whether the inventory itself is protected;
• whether risk assessments and classification records align with inventory data.

Sampling is important. Pick assets from operations, projects, procurement, cloud subscriptions, paper records, and disposal records, then verify that they appear correctly in the inventory.

Evidence examples

Strong evidence

• Inventory includes information, physical, virtual, software, service, process, and documentation assets relevant to the ISMS.
• Important assets have owners and, where needed, custodians.
• Classification, business value, location, retention, backup, and recovery details are recorded.
• New assets and disposals are reflected through project, procurement, and change processes.
• Asset owners participate in risk assessment and classification.
• Inventory accuracy is tested periodically.
• Disposal records show when, how, and to whom assets were disposed.
• Inventory access is restricted and backed up.

Weak evidence

• Inventory only lists laptops and ignores information assets.
• Assets have no owner.
• Inventory has owners but no evidence they know their responsibilities.
• Classification is missing or stale.
• New systems are not added until annual review.
• Disposals are not recorded.
• Software and cloud services are not tracked.
• Inventory is an uncontrolled spreadsheet with broad access.

Common failures

Exam traps

• Asset inventory is not only hardware. It includes information and associated assets.
• Owner does not mean day-to-day user or IT operator. The owner is accountable for the asset and protection expectations.
• A custodian can perform daily tasks, but accountability remains with the owner.
• Assets that are liabilities, such as retained identity documents, still need inventory, protection, retention, and disposal control.
• The inventory must be maintained, not merely created once.
• Project and change management should update the inventory.

Related controls and concepts

• Risk Assessment
• Statement of Applicability
• A.5.2 Information Security Roles and Responsibilities
• A.5.8 Information Security in Project Management
• Information Security Management System
• Internal Audit
• Management Review
• Control Owner Register

KB-ready summary

A.5.9 requires a maintained inventory of information and associated assets, including owners. The inventory should support risk assessment, classification, protection, backup, recovery, retention, disposal, and audit evidence. Important assets need accountable owners, and day-to-day custodians can be assigned without removing owner accountability.

Templates and checklists

• Information and Associated Asset Inventory
• A.5.9 Audit Checklist
• Control Owner Register
• Risk and Control Mapping Table