Control A.5.9Inventory of information and other associated assets
What it means in practice
An inventory of information and other associated assets, including owners, must be developed and maintained.
Two things are frequently lost. The inventory covers information, not only equipment — a customer database is an asset whether or not anyone knows which server it sits on. And it carries owners, which is what makes classification under A.5.12, access decisions under A.5.15 and risk ownership under clause 6.1.2 possible.
Perfect completeness is not the standard; usefulness is. An inventory that lists every workstation and omits the finance system is worse than one that starts with what matters and grows.
The practical difficulty is maintenance. Any inventory that depends on people remembering to update it is out of date within a quarter, which is why the ones that work are derived from systems that already know — directory services, cloud provider inventories, configuration management — with human curation for the information layer those tools cannot see.
How to put this in place
Almost every other control, from classification to patching, depends on knowing what you hold and who is responsible. An ISMS project that skips the inventory finds gaps in scope later, usually at audit.
- Decide which asset types to list: information, systems, cloud services, devices and key people-held data.
- Build the list from automated sources where you can, such as device management and cloud accounts.
- Assign an owner to each asset and tell them.
- Reconcile the list against reality at least every quarter and record it.
- Link the inventory to classification and the leaver process; see also A.5.11 and A.5.12.
Evidence an auditor usually looks for: the inventory with owners, a sample of assets traced from the list to reality and back, and the record of the last reconciliation.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Mandatory ISMS Documentation Checklist
in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists inventory of information and other assets, with owners among the documents auditors commonly expect for this control. - Word
Stage 1 and Stage 2 Audit Preparation Guide
in ISO 27001 Implementation & Certification ReadinessListed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge. - Excel
Scan Coverage & Asset Scope Register
in Vulnerability & Exposure ManagementIts Framework References list this control. Supported by: Asset ID, owner and criticality columns. - Excel
Access Review Scope & System Inventory
in User Access ReviewIts Framework References list this control. Supported by: Inventory sheet: the systems that hold information, each with an owner and the service it supports. - Excel
Information Asset Register
in Information Classification & HandlingIts Framework References list this control. Supported by: Information assets: the inventory of information assets with their owners. - Excel
Information Ownership Responsibility Matrix
in Information Classification & HandlingIts Framework References list this control. Supported by: Asset owners: an owner for every information asset in the inventory. - Excel
End-of-Life Software & Unsupported System Register
in Patch ManagementIts Framework References list this control. Supported by: The register as part of the asset inventory: each system's owner, support dates and plan. - Excel
AI System & Use Case Inventory
in AI Security Governance & Acceptable UseIts Framework References list this control. Supported by: Inventory sheet: the inventory of information and other associated assets includes the AI tools and the uses made of them.