Control A.5.9Inventory of information and other associated assets
An inventory of information and other associated assets, including owners, must be developed and maintained.
Two things are frequently lost. The inventory covers information, not only equipment — a customer database is an asset whether or not anyone knows which server it sits on. And it carries owners, which is what makes classification under A.5.12, access decisions under A.5.15 and risk ownership under clause 6.1.2 possible.
Perfect completeness is not the standard; usefulness is. An inventory that lists every workstation and omits the finance system is worse than one that starts with what matters and grows.
The practical difficulty is maintenance. Any inventory that depends on people remembering to update it is out of date within a quarter, which is why the ones that work are derived from systems that already know — directory services, cloud provider inventories, configuration management — with human curation for the information layer those tools cannot see.
How to put this in place
Almost every other control, from classification to patching, depends on knowing what you hold and who is responsible. An ISMS project that skips the inventory finds gaps in scope later, usually at audit.
- Decide which asset types to list: information, systems, cloud services, devices and key people-held data.
- Build the list from automated sources where you can, such as device management and cloud accounts.
- Assign an owner to each asset and tell them.
- Reconcile the list against reality at least every quarter and record it.
- Link the inventory to classification and the leaver process; see also A.5.11 and A.5.12.
Evidence an auditor usually looks for: the inventory with owners, a sample of assets traced from the list to reality and back, and the record of the last reconciliation.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists inventory of information and other assets, with owners among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.