Menu
Learn how to define your ISO 27001 information assets and build an asset register for successful certification.
You might think of an “information asset” as information that is an asset to your organisation. You would be right, but in the context of ISO 27001 information assets also include assets associated with the information, as well as information processing facilities.
In plain English, this means all your hardware, software, devices (desktops, laptops, smartphones, tablets), offices and the people who have access to any/all of these are considered “information assets”. You need to have an inventory of all of those.
In this article, you will learn how to define your information assets and build an asset register:
Reading time: 4 minutes
The ISO 27001 standard requires you to have an inventory of all your information assets, which they refer to as an “asset register.” The Asset Register should be accurate, up-to-date, consistent, and aligned with any other asset register you may already have; each asset must have an owner, and each asset must have a “classification” (more on that later. It makes sense to define your classification scheme before you build your Asset Register, but don’t worry about it for now).
The types of assets you need to add to your Asset Register will vary depending on a few factors but will primarily depend on where your network infrastructure is, whether you have office premises and whether you store paper documents.
We like to group assets into categories. We’ve found it makes it easier to manage and keep up to date as you can assign different people to maintain different categories.
Examples of some information assets commonly found in each category are listed below.
Note that the assets you MUST add in your register are Information assets. This doesn’t mean you can’t add other assets that are not related to the information you wish to protect.
Many organisations take the opportunity of building an asset register for their ISO 27001 certification to catalogue all their assets. Monitors, headsets, desks, laptop bags, desks, vehicles, etc, are often found all in the same register. Similarly, if you already have an Asset Register for large items, you may wish to use it for the purpose of ISO 27001. The choice is yours.
The video above walks you through the use of our free asset register template.
Note: define your classification scheme before starting on your asset register.
Note: on the people tab, if you have a separate list of staff or an HR system, you may wish to simply refer to it from the people tab as a single line.
Download our free asset register template
The template is easy-to-use, if you get stuck refer back to the video above or get in touch.
Elisabeth is an Associate Consultant of the British Standards Institute (BSI), a BSI qualified ISO Lead Auditor and member of the Standard Committee responsible for the publication of the BS 10008 Standard.
Elisabeth can help you decide if ISO 27001 is for you and support you through its implementation, all the way to certification.