Asset Inventory Template ISO 27001

Standard Operating Procedure: ISO 27001 Asset Inventory Management

1. Executive Summary & Purpose

This procedure defines the methodology for identifying, documenting, and maintaining an exhaustive Information Asset Inventory in accordance with ISO/IEC 27001:2022 (Annex A.5.9). The purpose is to ensure all information and supporting assets are identified, categorized, and assigned designated owners to mitigate security risks and ensure business continuity.

2. Scope & Prerequisites

• Scope: All physical, software, information, and intangible assets owned or leased by Template Registry.
• Prerequisites:
  • Access to the Central Asset Management System (CAMS) or authorized GRC tool.
  • Administrative read/write privileges to the network discovery dashboard.
  • Finalized Data Classification Policy.

3. Roles & Responsibilities (RACI)

4. Step-by-Step Procedure

Phase I: Asset Identification & Discovery

• Execute network discovery scans to identify hardware nodes.
• Extract software inventory from endpoint management tools (e.g., Jamf, Intune).
• Catalog information assets (databases, file shares, physical documents) via departmental interviews.

Phase II: Classification & Valuation

• Assign a Criticality Rating (1-5) to each asset based on impact to CIA triad (Confidentiality, Integrity, Availability).
• Assign a Data Classification (Public, Internal, Confidential, Restricted).
• Map each asset to a specific Owner (The individual responsible for the asset’s lifecycle).

Phase III: Integration & Maintenance

• Input data into the master Asset Registry.
• Update the Risk Register for any asset identified as "High" or "Critical" criticality.
• Configure automated alerts for changes in the configuration baseline of critical assets.

5. Quality Assurance & Pro-Tips

QA Metrics

• Completeness: 100% of discovered network nodes must be mapped to an owner.
• Accuracy: Quarterly reconciliation audits must demonstrate <2% drift between discovery logs and the Asset Registry.

Pro-Tips

• Avoid "Ghost Assets": Always mandate a "decommissioning" step. If a server is retired, the asset must be marked as "Archived" rather than deleted to maintain historical audit trails.
• Automation: Utilize Agent-based discovery. Manual spreadsheets are the leading cause of non-compliance during ISO 27001 surveillance audits.

6. Frequently Asked Questions

Q: Who should be designated as the Asset Owner? A: The Asset Owner must be a person, not a department. It is the individual with the authority to approve access rights and decide the classification level of the information processed.

Q: How do we handle third-party/SaaS assets? A: SaaS platforms are "Information Assets." They must be inventoried with the designated vendor contact, contract expiration date, and a link to the relevant Data Processing Agreement (DPA).

Julian Vance
Chief Architect, Template Registry
Controlled Document: Unauthorized redistribution prohibited.