Information Asset Register
Records information assets with owner, classification, location, personal-data flag and retention rule.
Available soon
- Format
- Excel
- Size
- 85 KB
- Length
- 12 sheets
- Version
- 2.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 2.0
Rewritten to the depth of the other CISO Times packs: the 16 register fields in full, the three impacts on the risk scale with the level they give beside the owner's level, markers, access, retention and a calculated review date; a change log and legal holds; a Summary with the measures ICM-01 and ICM-02; a Field guide; and the distributor's 17 assets as the worked example.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Set the As-at date on the Summary sheet. The EXAMPLE uses 2026-09-30, the example quarter end; use today's date, or type =TODAY(). The review intervals there come from the Information Classification & Handling Policy (CL-03, CL-12). |
| 2 | Add one row on Information assets for each body of information managed as one unit, with one owner and one purpose (CL-01). Copies and regular exports belong to their asset; name them in "Where it is held". Name the owner as a role, never a team (CL-03), and the custodian who runs it. |
| 3 | Rate confidentiality, integrity and availability on the risk scale's impact levels, 1 to 4, against the impact criteria in the Information Asset Classification Workbook, taking the worst area for each (CL-02). The register shows the level they give: any High rating (3 or 4) gives Confidential; a highest of Medium (2) gives Internal; all Low (1) gives Public only with a release decision (CL-05), otherwise Internal. |
| 4 | Enter the level the owner approved, the markers and the reason. Until the owner decides, leave the level blank: the row shows "Awaiting the owner's decision: handled as Internal (CL-04)". A level above the ratings is allowed with a recorded reason; one below them is not. |
| 5 | Fill in who may access it (the role profiles of the joiner-mover-leaver pack, or non-standard access), the retention rule from your retention schedule, and the dates of the last review and the last material change. The next review date calculates: 12 months after the review, or 15 working days after a later material change, whichever is sooner. |
| 6 | Log every change on the Change log sheet: a new asset, a new location or export, a re-rating, a new supplier. Record legal holds on the Legal holds sheet as Legal issues them, and mark the assets they cover (CL-15). |
| 7 | Report the Summary measures monthly to the security and it leadership team (CL-20). Clear every Check that does not say OK, and delete the EXAMPLE rows before the register is approved. Do not type over the white calculated columns. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. It approved its policy on 14 Jul 2026 and built this register by 28 Aug 2026. At 30 Sep 2026, 16 of 17 assets are classified (2 Public, 7 Internal, 7 Confidential); the freight rate site found on 15 Sep 2026 awaits its owner. The customer price list was re-rated Confidential on 17 Sep 2026 once the export of every customer's prices was found open to all staff (CL-13). The shift rotas' review after their move to the warehouse system was due 28 Sep 2026 and is late.
Tailoring for a small organisation: start with the assets that matter most (customer, financial and staff data first) and fill every column for them; add the rest over the first year. Combine the owner and custodian where one person runs a system, but keep the owner a manager.
Tailoring for a regulated entity: NIS2's Implementing Regulation (EU) 2024/2690 expects a complete, accurate and current inventory with changes recorded traceably (Annex 12.4.1), and DORA expects information assets identified, mapped and their classification reviewed at least yearly (Article 8(1), 8(4), 8(6)). Keep the Change log, and review every row at least once a year.
Tailoring where a service provider runs your IT: the provider is usually the custodian of the systems it runs. The owner stays inside your organisation and decides the level. Name the provider in the suppliers column with its third-party pack reference, and ask it each year for the locations and exports it holds.
Information assets
One row per information asset (CL-01). Impacts are the risk scale's levels, 1 to 4. Yellow columns are inputs; white columns calculate. Until the owner decides, an asset is handled as Internal (CL-04).
| Example | Asset ID | Information asset | Purpose | Owner | Custodian | Where it is held, with regular copies and exports | Systems | Suppliers that hold it (third-party pack) | Confidentiality (impact level 1–4) | Integrity (impact level 1–4) | Availability (impact level 1–4) | Release approved | Level the ratings give (calc) | Level approved by the owner | Personal data? | Special category? | Legal hold? | Reason: the harm that sets the level | Who may access it | Retention rule | Last material change | Last review | Reviewed by | Next review due (calc) | Status (calc) | Review (calc, ICM-02) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | IA-01 | Customer accounts and order history | Take, deliver and invoice customer orders | Chief Operating Officer | Head of IT | ERP (P07 SYS-01), hosted by the ERP software provider (P06 SUP-004); delivery lists on warehouse laptops | SYS-01 | SUP-004 ERP software provider (hosted) | 4 | 3 | 3 | No | Confidential | Confidential | Yes | No | No | Names, delivery addresses and order histories of every customer: personal and customer data at scale. | RP-03 Customer service agent; RP-06 Sales account manager | [[6 years after the last order]] | 21 Aug 2026 | Chief Operating Officer | 21 Aug 2027 | Classified | On time | OK | |
| EXAMPLE | IA-02 | Customer price lists and discount terms | Quote and invoice each business customer at its agreed prices | Sales Director | Head of IT | ERP (P07 SYS-01); the monthly export of every customer's prices | SYS-01 | SUP-004 ERP software provider (hosted) | 3 | 3 | 2 | No | Confidential | Confidential | No | No | No | Every customer's prices and discounts together would let a competitor undercut bids and customers reopen terms; a price changed in bulk is invoiced wrongly. | RP-06 Sales account manager | [[2 years after the price list is replaced]] | 17 Sep 2026 | Sales Director | 17 Sep 2027 | Classified | On time | OK | |
| EXAMPLE | IA-03 | Online orders and customer sign-in accounts | Run the online ordering service | Chief Operating Officer | Head of IT | Online ordering platform, hosted by the cloud hosting provider (P06 SUP-002) | SYS-04 | SUP-002 Cloud hosting provider | 4 | 3 | 4 | No | Confidential | Confidential | Yes | No | No | Takes 60% of orders; customer accounts at scale; an outage of more than 2 days is the risk register's R-01. | Administrators under the privileged access pack (P14) | [[6 years after the last order]] | 21 Aug 2026 | Chief Operating Officer | 21 Aug 2027 | Classified | On time | OK | |
| EXAMPLE | IA-04 | Payroll and staff bank details | Pay staff correctly and on time | Chief Financial Officer | Head of IT | ERP payroll (P07 SYS-01) and the payroll bureau's portal (P06 SUP-012) | SYS-01 | SUP-004 ERP software provider (hosted); SUP-012 Payroll bureau | 4 | 4 | 3 | No | Confidential | Confidential | Yes | No | No | Pay and bank details of every member of staff; a wrong payment run hits the whole workforce. | Payroll team, by non-standard access the owner approves (P13 JML-04) | [[as payroll and tax law requires]] | 24 Aug 2026 | Chief Financial Officer | 24 Aug 2027 | Classified | On time | OK | |
| EXAMPLE | IA-05 | Staff HR records, including sickness absence | Employ, manage and support staff | HR Director | Head of IT | HR system | 4 | 2 | 2 | No | Confidential | Confidential | Yes | Yes | No | Health information about named staff: special category data (CL-14). | HR team, by non-standard access the owner approves (P13 JML-04) | [[6 years after employment ends]] | 24 Aug 2026 | HR Director | 24 Aug 2027 | Classified | On time | OK | |||
| EXAMPLE | IA-06 | Supplier master data and bank details | Pay suppliers correctly | Chief Financial Officer | Head of IT | ERP (P07 SYS-01) | SYS-01 | SUP-004 ERP software provider (hosted) | 2 | 3 | 2 | No | Confidential | Confidential | No | No | No | A changed bank detail diverts a payment run: the risk register's R-02, and the attempt in the incident pack's INC-2026-015. Integrity sets the level. | RP-04 Accounts payable clerk | [[6 years after the supplier is closed]] | 24 Aug 2026 | Chief Financial Officer | 24 Aug 2027 | Classified | On time | OK | |
| EXAMPLE | IA-07 | Board and executive committee papers | Govern the company | Chief Executive | Head of IT | Restricted board folder in managed storage | 3 | 2 | 1 | No | Confidential | Confidential | No | No | No | Investment decisions and results before they are announced. | Named directors and committee members | [[10 years]] | 25 Aug 2026 | Chief Executive | 25 Aug 2027 | Classified | On time | OK | |||
| EXAMPLE | IA-08 | Warehouse stock levels and dispatch plans | Pick, pack and dispatch orders | Head of Logistics | IT Operations Manager | Warehouse management system (P07 SYS-02), supported by its provider (P06 SUP-010) | SYS-02 | SUP-010 Warehouse management system provider | 1 | 2 | 2 | No | Internal | Internal | No | No | No | An outage of hours slows dispatch and is restored from backup; nothing in it harms anyone if seen. | RP-01 Warehouse operative; RP-02 Warehouse team leader; RP-07 Transport planner | [[2 years]] | 26 Aug 2026 | Head of Logistics | 26 Aug 2027 | Classified | On time | OK | |
| EXAMPLE | IA-09 | Warehouse shift rotas | Plan staff cover at the three warehouses | Head of Logistics | IT Operations Manager | Scheduling module of the warehouse management system (P07 SYS-02), since 7 Sep 2026; spreadsheets before | SYS-02 | SUP-010 Warehouse management system provider | 2 | 1 | 2 | No | Internal | Internal | Yes | No | No | Staff names and shifts: personal data with limited harm. Internal with the Personal data marker (CL-07). | RP-02 Warehouse team leader | [[18 months]] | 7 Sep 2026 | 26 Aug 2026 | Head of Logistics | 28 Sep 2026 | Classified | Overdue | OK |
| EXAMPLE | IA-10 | Policies, standards and procedures | Tell staff and suppliers the rules | Head of Information Security | IT Operations Manager | Intranet | 1 | 2 | 1 | No | Internal | Internal | No | No | No | Not harmful if seen; an unauthorised edit could mislead staff until noticed. | All staff and approved suppliers | [[superseded versions 6 years]] | 27 Aug 2026 | Head of Information Security | 27 Aug 2027 | Classified | On time | OK | |||
| EXAMPLE | IA-11 | Sales forecasts and marketing plans | Plan sales and campaigns | Sales Director | IT Operations Manager | Sales team site | 2 | 1 | 1 | No | Internal | Internal | No | No | No | Useful to a competitor for a season; limited harm. | Sales and marketing staff | [[3 years]] | 19 Aug 2026 | Sales Director | 19 Aug 2027 | Classified | On time | OK | |||
| EXAMPLE | IA-12 | IT network diagrams and system documentation | Run and support the IT estate | Head of IT | IT Operations Manager | IT documentation site, shared with the managed IT provider (P06 SUP-001) | SUP-001 Managed IT service provider | 2 | 2 | 2 | No | Internal | Internal | No | No | No | Helps an attacker plan, but holds no credentials: those are in the vault (P14 PA-10). | IT staff and the managed IT provider | [[while current, then 2 years]] | 27 Aug 2026 | Head of IT | 27 Aug 2027 | Classified | On time | OK | ||
| EXAMPLE | IA-13 | Supplier product data: specifications, barcodes and pack sizes | List and sell the products | Procurement Manager | Head of IT | ERP (P07 SYS-01) | SYS-01 | SUP-004 ERP software provider (hosted) | 1 | 2 | 1 | No | Internal | Internal | No | No | No | Published by suppliers anyway; wrong data causes picking errors until corrected. | Staff with ERP access | [[while the product is listed, then 2 years]] | 20 Aug 2026 | Procurement Manager | 20 Aug 2027 | Classified | On time | OK | |
| EXAMPLE | IA-14 | Customer service scripts and answers to common questions | Answer customers consistently | Chief Operating Officer | IT Operations Manager | Customer service knowledge base | 1 | 1 | 1 | No | Internal | Internal | No | No | No | Every impact Low, but never released: Internal (CL-04, CL-05). | Customer service staff and the outsourced contact centre (P06 SUP-013) | [[while current]] | 21 Aug 2026 | Chief Operating Officer | 21 Aug 2027 | Classified | On time | OK | |||
| EXAMPLE | IA-15 | Published product catalogue and website pages | Show customers what can be ordered | Head of Marketing and Communications | Head of IT | Public pages of the online ordering platform (P06 SUP-002); master in the ERP (IA-13) | SUP-002 Cloud hosting provider | 1 | 1 | 1 | Yes | Public | Public | No | No | No | Release approved by the owner; prices are shown only after sign-in, from IA-02. | Anyone | [[while current]] | 21 Aug 2026 | Head of Marketing and Communications | 21 Aug 2027 | Classified | On time | OK | ||
| EXAMPLE | IA-16 | Press releases and the published annual report | Tell the public about the company | Head of Marketing and Communications | Head of IT | Company website | 1 | 1 | 1 | Yes | Public | Public | No | No | No | Released on publication; drafts before release are Confidential board papers (IA-07). | Anyone | [[10 years]] | 25 Aug 2026 | Head of Marketing and Communications | 25 Aug 2027 | Classified | On time | OK | |||
| EXAMPLE | IA-17 | Freight rates and quotes on the rate comparison site | Compare and book carriers | Head of Logistics | Transport office administrator | Freight rate comparison site (P13 SYS-10), found by discovery on 15 Sep 2026 | SYS-10 | No | Internal | No | No | No | Awaiting the owner's decision: handled as Internal meanwhile (CL-04). | RP-07 Transport planner | [[to be set]] | 15 Sep 2026 | Awaiting the owner's decision: handled as Internal (CL-04) | Owner to rate and decide (CL-03) |
Change log
Every change to the register, so each entry can be traced (CL-03, CL-12). A material change is reviewed within 15 working days; the Field guide lists what counts.
| Example | Change ID | Asset ID | Date of the change | What changed | Rule | Level before | Level after | Recorded by | Review due (calc) | Reviewed on | Result (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | CH-01 | IA-02 | 19 Aug 2026 | First classified when the register was built, from the habit of sending each customer its own price list. | CL-03 | Internal | Sales Director | 9 Sep 2026 | 19 Aug 2026 | Reviewed on time | |
| EXAMPLE | CH-02 | IA-09 | 7 Sep 2026 | Shift rotas moved from spreadsheets into the scheduling module of the warehouse management system: a new system and location, so a material change. | CL-03 | Internal | Internal | IT Operations Manager | 28 Sep 2026 | Overdue | |
| EXAMPLE | CH-03 | IA-17 | 15 Sep 2026 | Freight rates and quotes on the rate comparison site: found by discovery of the freight rate comparison site (P13 SYS-10). Added to the register; handled as Internal until the owner decides. | CL-04 | Internal | Head of Information Security | 6 Oct 2026 | Not yet due | ||
| EXAMPLE | CH-04 | IA-02 | 17 Sep 2026 | The monthly export of every customer's prices and discounts was saved on a sales team site that all 900 staff could open, labelled Internal. Each customer receives its own price list, so confidentiality and integrity had been rated Medium for one list, not for every list together. | CL-13 | Internal | Confidential | Sales Director | 8 Oct 2026 | 17 Sep 2026 | Reviewed on time |
Legal holds
Each legal hold Legal has issued. A legal hold overrides the schedule: nothing under hold is deleted, changed or disposed of until Legal releases the hold in writing (CL-15). The records manager applies the hold in each system and tells the custodians and the disposal provider.
| Example | Hold ID | In force from | Instructed by | What it covers | Why | Assets or items covered | Released on | Status (calc) |
|---|---|---|---|---|---|---|---|---|
| EXAMPLE | LH-2026-01 | 12 Aug 2026 | Legal | Evidence of the ransomware incident INC-2026-014: the images of the 14 Warehouse 2 office PCs taken before they were rebuilt, and the incident's logs | The crime report and the cyber insurer's notice made for the incident (P09 RD-16, RD-15) | None in the register: the incident's evidence | In force: nothing covered is changed, deleted or disposed of (CL-15) |
Release: [[when Legal releases it in writing]]. When a hold is released, record the date and clear the Legal hold marker on the assets it covered.
Summary
Register summary
Every figure is calculated from the Information assets sheet at the As-at date. The measures go monthly to the security and it leadership team; ICM-03 and ICM-04 count the quarter. A measure outside tolerance goes to the next executive committee with its plan.
| As-at date | 30 Sep 2026 | EXAMPLE: the example quarter end. Use today's date, or type =TODAY(). |
| Review at least every (months) | 12 | CL-12. |
| Review after a material change within (working days) | 15 | CL-03. Working days are Monday to Friday; add your public holidays to the WORKDAY formulas if you need them. |
Headline measures
| Measure | Result | Of | Share | Target | Tolerance | Status | What it counts |
|---|---|---|---|---|---|---|---|
| ICM-01 Information assets classified with an owner | 16 | 17 | 94% | 100% | 90% | Below target, within tolerance | Register entries with a named owner and an owner-approved level at the period end, out of all register entries. |
| ICM-02 Classification reviews on time | 15 | 16 | 94% | 100% | 90% | Below target, within tolerance | Classified assets whose last review is within 12 months and after their last material change, or still within the 15 working days a change allows, at the period end, out of all classified assets. |
Target and tolerance are the EXAMPLE's (tolerance [[90%]]); set your own with the leadership team. ICM-03 and ICM-04 are counted in the incident pack's log and the Secure Information Disposal Checklist.
The register by level and marker
| Count | Assets | What it means | |||||
|---|---|---|---|---|---|---|---|
| Classified Public | 2 | Approved by the owner at Public. | |||||
| Classified Internal | 7 | Approved by the owner at Internal. | |||||
| Classified Confidential | 7 | Approved by the owner at Confidential. | |||||
| Awaiting the owner's decision | 1 | Handled as Internal meanwhile (CL-04). | |||||
| Carry the Personal data marker | 5 | Data protection law applies whatever the level (CL-07). | |||||
| Carry the Special category marker | 1 | Always Confidential (CL-14). | |||||
| Under a Legal hold | 0 | Nothing covered is changed or disposed of (CL-15). Holds on items outside the register are on the Legal holds sheet. | |||||
| Held by at least one supplier | 10 | Each supplier under contract terms that protect it (CL-16). | |||||
| Reviews overdue | 1 | Past the next review date at the As-at date. | |||||
| Rows with a check to resolve | 1 | Every Check should say OK, or the owner is still deciding. | |||||
Field guide
Field guide
What each field records and the rule of the Information Classification & Handling Policy it serves, what counts as a material change, how retention works, and the quarterly handling check.
The register's fields
| Field | What to record | Rule | What the rule says |
|---|---|---|---|
| Asset ID | IA-nn | CL-12 | Information owners and custodians review the register at least every [[12]] months and after a material change. |
| Information asset and purpose | What it is and what it is for, in the owner's words | CL-01 | Classify information, and the system or medium that holds it, before it is used, shared or retained. A system or medium takes the highest level of the information it holds. |
| Owner | A named role, never a team | CL-03 | Information owners approve the level and review it when the purpose, users, law, a supplier or the risk changes, within [[15]] working days of the change. |
| Custodian | Who runs it: IT, an administrator or a supplier | CL-06 | Apply the handling rule for the level to every action: storing, accessing, sharing inside and outside the organisation, transferring, printing, remote and mobile working, AI tools, retaining and disposing. |
| Where it is held | Systems, sites and regular copies or exports | CL-01 | Classify information, and the system or medium that holds it, before it is used, shared or retained. A system or medium takes the highest level of the information it holds. |
| Suppliers that hold it | P06 reference and tier | CL-16 | A supplier stores, processes or receives Internal or Confidential information only under contract terms that protect it (P06 clause CL-01, P06 clause CL-07, P06 clause CL-13, and P06 clause CL-06 where it processes personal data). Confidential information goes to a supplier only after its assessment under the third-party pack has ended in a documented decision to approve it (P06 TP-05). |
| Confidentiality, integrity, availability | Each rated Low, Medium or High, with the P05 impact level | CL-02 | Use the highest level justified by the confidentiality, integrity or availability impact, each rated on the risk scale's impact levels. Do not label everything Confidential by default: value is not harm. |
| Level | Public, Internal or Confidential | CL-02 | Use the highest level justified by the confidentiality, integrity or availability impact, each rated on the risk scale's impact levels. Do not label everything Confidential by default: value is not harm. |
| Markers | Personal data, Special category, Legal hold | CL-07 | Personal data is protected under data protection law (GDPR) regardless of the classification label, and carries the Personal data marker. The label does not decide whether processing is lawful. |
| Reason | The harm that sets the level | CL-03 | Information owners approve the level and review it when the purpose, users, law, a supplier or the risk changes, within [[15]] working days of the change. |
| Who may access it | P13 role profiles, or non-standard access | CL-17 | Access to Confidential information is granted only through an approved role profile or approved non-standard access with an expiry (P13 JML-03, JML-04), is reviewed in every access review (P07 AR-02), and administrator access to systems that hold it follows the privileged access pack (P14 PA-02, PA-06, PA-07). |
| Retention rule | From the retention schedule | CL-11 | Dispose of information and media using the level's disposal rule and the method for the media type. Keep a certificate for every Confidential item a provider sanitises or destroys, due within [[10]] working days of collection, and a disposal record for every item destroyed in house. |
| Last material change | Date and what changed | CL-03 | Information owners approve the level and review it when the purpose, users, law, a supplier or the risk changes, within [[15]] working days of the change. |
| Last review | Date, and who reviewed | CL-12 | Information owners and custodians review the register at least every [[12]] months and after a material change. |
| Next review | Within [[12]] months, or [[15]] working days after a change | CL-12 | Information owners and custodians review the register at least every [[12]] months and after a material change. |
| Status | Classified, or awaiting the owner's decision (held Internal) | CL-04 | The default for new business information is Internal until its owner records a different decision. Information whose classification is incomplete is handled as Internal. |
A material change: review within the working days set on the Summary
Change
| 1 | A new system, location or regular export | ||
| 2 | A new supplier, or a change in what a supplier does with it | ||
| 3 | A new purpose or audience | ||
| 4 | Personal or special category data added | ||
| 5 | An incident involving it | ||
| 6 | A change in law or contract | ||
Retention
Every asset in the register names its retention rule from the schedule. Personal data is kept no longer than its purpose needs (GDPR storage limitation). At the end of the period it is deleted or disposed of by the level's rule, unless a legal hold applies. A legal hold overrides the schedule: nothing under hold is deleted, changed or disposed of until Legal releases the hold in writing (CL-15). The records manager applies the hold in each system and tells the custodians and the disposal provider.
| Record | Typical retention rule | ||
|---|---|---|---|
| Customer orders and invoices | [[as tax and accounting law requires]] | ||
| Payroll records | [[as payroll and tax law requires]] | ||
| HR records of a leaver | [[n]] years after employment ends | ||
| Superseded price lists | [[n]] years after replacement | ||
| Security logs | At least the period the privileged access pack and supplier contracts set, and [[n]] months in all | ||
| Disposal certificates | [[n]] years after disposal | ||
Your schedule: [[the organisation's retention schedule, kept by the records manager]]. The periods above are prompts, not legal advice.
The quarterly handling check
Each quarter the Head of Information Security checks a sample of [[5]] Confidential assets where they are actually held: who can reach them, how they are labelled and shared, and whether exports exist the register does not show. The EXAMPLE's check on 17 Sep 2026 found the export of every customer's prices open to all staff (Change log, IA-02).
Lists
| Level | YesNo | RatingOfLevel |
|---|---|---|
| Public | Yes | Low |
| Internal | No | Medium |
| Confidential | High |
High
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Information asset | A body of information managed as one unit, with one owner and one purpose, such as the customer accounts and order history. Its copies, exports and extracts are part of it unless the owner records them as an asset of their own. |
| Information owner | The manager accountable for an information asset: decides its level, who may access it, how long it is kept and when it is released or destroyed. Approves the level, the purpose, who may access it, the retention period and any release; reviews the classification; approves non-standard access to it (P13 JML-04). |
| Custodian | The person or team that holds and runs the information for the owner, usually IT or a supplier: applies the access, storage, backup and disposal controls the level requires. Applies the technical handling the level requires: access, encryption, backup, logging, labelling in the system, and disposal. |
| Impact level (1 to 4) | The risk scale's impact levels, as the risk management pack sets them. Low, Medium or High: the harm one of confidentiality, integrity or availability could suffer, read from the risk scale's impact levels (Low is Minor, Medium is Moderate, High is Major or Severe). |
| Level the ratings give | Any High gives Confidential; a highest of Medium gives Internal; all Low gives Public only with a release decision, otherwise Internal (CL-02, CL-05). Incomplete ratings give Internal (CL-04). |
| Level approved by the owner | The owner's decision. It may be higher than the ratings give, with a recorded reason; never lower. |
| Marker | A word added to the level where a law or a duty adds rules of its own: Personal data, Special category or Legal hold. A marker never lowers a level. |
| Release | The owner's recorded decision that information may be given to anyone. Only release makes information Public. |
| Material change | Any of the changes listed on the Field guide. The classification is reviewed within 15 working days (CL-03). |
| Retention schedule | The organisation's list of how long each type of record is kept and why, kept by the records manager. |
| Legal hold | An instruction from Legal to keep named information unchanged, whatever its retention period, because of a claim, an investigation or an authority's request. |
| Who may access it | A role profile of the joiner-mover-leaver pack (RP-nn in the EXAMPLE), or non-standard access the owner approves with an expiry (P13 JML-04). |
| ICM-01 | Information assets classified with an owner: Register entries with a named owner and an owner-approved level at the period end, out of all register entries. |
| ICM-02 | Classification reviews on time: Classified assets whose last review is within 12 months and after their last material change, or still within the 15 working days a change allows, at the period end, out of all classified assets. |
| Status words | On target, Below target, within tolerance, and Outside tolerance: the KPI status words of the metrics pack (P11). |
| SYS-nn, SUP-nn, RP-nn | System, supplier and role profile references of the access review, third-party and joiner-mover-leaver packs, as the EXAMPLE uses them. |
| (calc) | A column the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, 900 staff, as at 2026-09-30. Delete the EXAMPLE rows before approval. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.9 — Inventory of information and other associated assets | Information assets: the inventory of information assets with their owners |
| ISO/IEC 27001:2022 | Annex A 5.12 — Classification of information | Information assets: the three impacts, the level they give and the owner's level |
| NIST CSF 2.0 | ID.AM-07 — “Inventories of data and corresponding metadata for designated data types are maintained” | Information assets: the inventory of data with its metadata: owner, location, level, markers and retention |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | The whole register: asset management |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Who the Implementing Regulation binds; for other entities it shows what the regulator expects |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 12.4.1 — “The relevant entities shall develop and maintain a complete, accurate, up-to-date and consistent inventory of their assets. They shall record changes to the entries in the inventory in a traceable manner.” | Information assets and Change log: a complete, current inventory with changes recorded traceably |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 12.1.3 — “The relevant entities shall conduct periodic reviews of the classification levels of assets and update them, where appropriate.” | Last review, next review due and ICM-02: periodic review of the levels |
| DORA — Regulation (EU) 2022/2554 | Article 8(1) — identify, classify and document ICT-supported business functions, information assets and ICT assets, reviewed at least yearly | Information assets: information assets identified, classified and their classification reviewed at least yearly |
| DORA — Regulation (EU) 2022/2554 | Article 8(4) — “Financial entities shall identify all information assets and ICT assets, including those on remote sites, network resources and hardware equipment, and shall map those considered critical.” | Information assets: every information asset, including those held at remote sites and by suppliers |
| DORA — Regulation (EU) 2022/2554 | Article 8(6) — “For the purposes of paragraphs 1, 4 and 5, financial entities shall maintain relevant inventories and update them periodically and every time any major change as referred to in paragraph 3 occurs.” | Change log: the inventory updated periodically and on every major change |
| GDPR — Regulation (EU) 2016/679 | Article 5(1)(e) — personal data shall be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed” (‘storage limitation’), with the exceptions the Article sets for archiving, research and statistics | Retention rule and the Personal data marker: personal data kept no longer than necessary |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.