How do we…
How do we keep an asset inventory that stands up to an ISO 27001 audit?
Add to board memoOpen the memo
The short answer
- Recommendation
- List information assets and the systems, services and devices that hold them, from the systems that already know them. Give each an owner who has been told, trace a sample both ways, reconcile on a schedule and add assets when you buy or build them.
- Reasoning
- Classification, access, patching and the leaver process all depend on knowing what you hold and who is responsible. The common gaps are a list of laptops only, with no information or cloud services, owners who do not know they own anything, and no reconciliation since it was built. An auditor traces a few assets from the floor or the cloud console to the list, and from the list to the real thing.
- Considerations
- How fine the list is should follow your risks. Listing a group, such as all laptops or one production database, is reasonable when the owner and the rules are the same. This is a judgement, not a pack rule.
- The standard's text and its guidance standard, ISO/IEC 27002, are paywalled. The control is described from the pack and public guides.
- The reconciliation interval shown is the pack's guidance default. Your risk and your tooling decide yours.
- Looking in billing, single sign-on and expense records for unlisted services is common practice, not a pack rule.
The decision, step by step
Select any step for the reasoning behind it and where the pack covers it.
- Start
- Step
- Decision
- Outcome
- Loop back
Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.
Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.
Read as text
The same flow written out: each step, its reasoning and where the pack covers it. 18 steps.
Start
We must show an inventory of information and other assets
Almost every other control depends on it, from classification to patching. The pack's checklist lists the inventory with owners as a record, and the auditor samples it. Build it once from systems that already know, then keep it alive.
In the pack
- P08-A03 Annex A Control Implementation LibraryControl Library
- P08-A05 Mandatory ISMS Documentation ChecklistAnnex A Documents
Decision
Is the ISMS scope drafted?
The inventory covers what is in scope, and every row depends on it. The pack's order puts scope before the inventory, and says the inventory can start as soon as the scope is drafted. If the scope is not drafted, answer no.
- Yes: Decide what counts as an asset
- No, or not known: Draft the scope first, then return
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanSequencing that avoids rework
Outcome
Draft the scope first, then return
An inventory built before the scope is likely to be built again. Draft the scope and then come back.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanSequencing that avoids rework
Step
Decide what counts as an asset
Include information assets, and the systems, services and devices that hold them: cloud services, devices and key data held by people. A list of laptops only, with no information assets or cloud services, is the gap auditors reliably find.
In the pack
- P08-A03 Annex A Control Implementation LibraryControl Library
Step
Name a source of truth for each type
Use the system that already holds the list: device management for devices, cloud accounts and billing for cloud services, the identity directory for accounts, licence records for software. Existing pack registers can start you off.
In the pack
- P08-A03 Annex A Control Implementation LibraryControl Library
- P15-A05 Information Asset RegisterInformation assets
Decision
Can every source export its list?
An export is current and cheap to reconcile. If it cannot export, you must keep the list by hand, so keep that list short and owned.
- Yes: Pull the list from the source and merge
- No, or not known: Export what you can; list the rest by hand with an owner
In the pack
- P08-A03 Annex A Control Implementation LibraryControl Library
Step
Pull the list from the source and merge
Merge the exports into one view, or keep them as linked lists, as long as the auditor can trace one asset across them. Note the date and the source of each.
In the pack
- P08-A03 Annex A Control Implementation LibraryControl Library
Step
Export what you can; list the rest by hand with an owner
Pull what you can from each source that exports, and list the rest by hand, such as paper records or key data held by one person. Name an owner for the manual list. Keep it small enough that someone reviews it.
In the pack
- P08-A03 Annex A Control Implementation LibraryControl Library
Decision
Are cloud and SaaS services bought outside procurement included?
Services bought on a card outside procurement are a named gap for the cloud control. If you have not checked, answer no.
- Yes: Give each asset or group an owner, and tell them
- No, or not known: Find them from billing, single sign-on and expense records
In the pack
- P08-A03 Annex A Control Implementation LibraryControl Library
Step
Find them from billing, single sign-on and expense records
Look for recurring charges, applications in the identity provider and tools staff have signed up to. Add each to the inventory with an owner.
In the pack
- P08-A03 Annex A Control Implementation LibraryControl Library
Step
Give each asset or group an owner, and tell them
Owners who do not know they are owners are a named gap. The owner decides who may access it, how it is classified and what happens at the end. A group with the same owner and rules can be one row.
In the pack
- P08-A03 Annex A Control Implementation LibraryControl Library
- P15-A09 Information Ownership Responsibility MatrixAsset owners
Step
Tie it to classification, labelling, acceptable use and asset return
Classification is recorded against the asset and labels follow it, acceptable use covers it, and return of assets at leaving or contract end is driven from what each person holds. These depend on the inventory, so connect them once.
- Then: Trace a sample both ways
In the pack
- P08-A03 Annex A Control Implementation LibraryControl Library
Step
Trace a sample both ways
Pick a few assets from the floor or the cloud console and find them on the list. Then pick a few from the list and find them in reality. The auditor will do the same, so do it first.
In the pack
- P08-A10 Stage 1 and Stage 2 Audit Preparation GuideCommonly sampled Annex A controls
Decision
Did the sample find assets missing or owners who did not know?
Any miss means the list is not yet reliable. If you did not sample, answer yes.
- Yes, or not known: Add them, tell the owners, then sample again
- No: Reconcile on a schedule and keep the record
In the pack
- P08-A10 Stage 1 and Stage 2 Audit Preparation GuideCommonly sampled Annex A controls
Step
Add them, tell the owners, then sample again
Fix what the sample found, then take a fresh sample. Repeat until a sample passes.
- Then: Trace a sample both ways (back to an earlier step)
In the pack
- P08-A10 Stage 1 and Stage 2 Audit Preparation GuideCommonly sampled Annex A controls
Step
Reconcile on a schedule and keep the record
The pack's control guidance reconciles at least every quarter as its default. Record each reconciliation: the date, the person, what changed. Without one the list ages.
In the pack
- P08-A03 Annex A Control Implementation LibraryControl Library
Step
Add assets when they are bought or built
Tie the inventory to the purchase, change and joiner processes, so an asset is listed when it appears. Waiting for the reconciliation leaves gaps that the auditor can find.
In the pack
- P08-A03 Annex A Control Implementation LibraryControl Library
Outcome
Inventory in place: sourced, owned, sampled and reconciled
Keep the reconciliation records for the whole operating period. Do not describe a scanner's coverage list or a laptop spreadsheet as the inventory: neither covers information or cloud services.
In the pack
- P08-A05 Mandatory ISMS Documentation ChecklistAnnex A Documents
Practical checklist
- Draft the scope before listing anything.
- Decide the asset types: information, systems, cloud services, devices and key people-held data.
- Name a source of truth for each type and export from it where you can.
- Give each asset or group an owner and tell them.
- Trace a sample from the list to the real thing and back, and fix what the sample finds.
- Reconcile on a schedule, record each one, and add assets at purchase or build.
Evidence to have ready
- The inventory with owners.
- A sample of assets traced from the list to reality and back.
- The record of the last reconciliation.
- Leaver checklists matched to the inventory for a sample of leavers.
Assumptions
- Your ISMS scope is drafted, because the inventory covers what the scope covers.
- You can export a list from at least some of your systems, such as device management or cloud accounts.
- Information owners exist or can be named, for classification and for the inventory.
Not covered here
- Classifying information into levels. That is “How do we classify information without everything ending up "Confidential"?”.
- Making sure a scanner covers every asset. That is “How do we know our scanning covers everything it should?”.
- Who fixes a finding on a system nobody owns. That is “If the scanner reports a critical finding on a system nobody owns, then who fixes it?”.
- Finding SaaS accounts outside single sign-on. That is “If some SaaS accounts sit outside SSO, then how do we find and close the gaps?”.
Related questions
- How do we classify information without everything ending up "Confidential"?
- How do we know our scanning covers everything it should?
- If the scanner reports a critical finding on a system nobody owns, then who fixes it?
- How do we use our cloud providers' certificates and reports in our ISMS scope and Statement of Applicability?
- How do we set the scope of our ISMS?