‘How do we approach asset identification within our information security risk assessment?’. There are 2 aspects to this question; ‘which assets do we include?’ and ‘how granular do we make the list?’. This blog examines which assets or asset types to include and should be read in conjunction with another URM blog titled ‘How do I Approach Asset Identification Within My Information Security Risk Assessment?, where we stressed the need to stay at a high level when identifying your information assets.
One thing that we recommend you think about is categorising your assets. This is a useful process as it enables you to identify assets that could face similar threats or may contain similar vulnerabilities.
The following list is typical, but is by no means the only way to categorise your assets, as it depends on the nature of your business. As such, this is not an exhaustive list, but is a good starting point which, in our experience, addresses the majority of asset types:
- Equipment (non-technology equipment such as a fire safe)
- Intangibles (such as brand and reputation)
The first thing to note is that ‘information’ is at the top of the list. This should always be your first consideration as this is the focal point of what you are trying to protect. All of the other types are known as supporting assets because they help you to store, communicate or process the information. As such, they tend to inherit the value of the information itself. For example, we may split laptops out into two groups; a general one for all employees and one for those who store, process or communicate sensitive information. In this scenario, the latter group would naturally require greater levels of protection, as the impact of losing such a laptop would be higher.
As you can see in the list above, we have created subcategories in a couple of places as information can exist electronically, as well as on paper. We also might want to categorise hardware and software technology separately. As we mentioned earlier, you can begin to see that these asset types may suffer from the same types of impact, e.g., it doesn’t matter what the information is, if it is on paper then it all could be impacted by the threat of fire. Similarly, all suppliers need to be managed effectively and therefore we would want to guard against weaknesses in contracts etc.
These asset types can also be mapped to the ISO 27002 controls that provide protection against your information risks. For example, software assets would benefit from controls such as vulnerability and patch management, and hardware assets from air conditioning and suitable power provision. Your people assets would benefit from training and awareness processes, as well as from having suitable contracts of employment in place.
So, it is important to keep your goal in mind i.e., through risk assessment, to identify and then manage your risks in terms of confidentially, integrity and availability (CIA). To do this, you need to achieve a manageable and actionable representation of risk for which you need a manageable asset list.
Having been involved in over 350 successful ISO 27001 certifications, URM is ideally placed to advise you on the essential activities and tasks you will need to carry out in order to maintain and improve your ISO 27001 auditing function and programme
URM can help you get ISO 27001 certification
URM can help you with ISO 27001 audit
In this blog, we are going to look at governance. We are regularly asked, ‘is information governance the same as IT governance?’
In this blog, we aim to provide 10 top tips to enable you to keep important information assets safe and secure whilst working remotely.
ISO 27001 is a standard for Information Security Management that provides any organisation with a framework to protect most valuable assets.