How do you Categorise Your Assets When Conducting an Information Security Risk Assessment?

19 Jul

Table of Contents

‘How do we approach asset identification within our information security risk assessment?’.   There are 2 aspects to this question; ‘which assets do we include?’ and ‘how granular do we make the list?’.  This blog examines which assets or asset types to include and should be read in conjunction with another URM blog titled ‘How do I Approach Asset Identification Within My Information Security Risk Assessment?, where we stressed the need to stay at a high level when identifying your information assets.

One thing that we recommend you think about is categorising your assets.  This is a useful process as it enables you to identify assets that could face similar threats or may contain similar vulnerabilities.

The following list is typical, but is by no means the only way to categorise your assets, as it depends on the nature of your business.  As such, this is not an exhaustive list, but is a good starting point which, in our experience, addresses the majority of asset types:

  • Information
    –  Electronic
    –  Paper
  • People
  • Premises
  • Suppliers
  • Equipment
  • Technology
    –  Hardware
    –  Software
  • Equipment (non-technology equipment such as a fire safe)
  • Intangibles (such as brand and reputation)

The first thing to note is that ‘information’ is at the top of the list.  This should always be your first consideration as this is the focal point of what you are trying to protect.  All of the other types are known as supporting assets because they help you to store, communicate or process the information.  As such, they tend to inherit the value of the information itself. For example, we may split laptops out into two groups; a general one for all employees and one for those who store, process or communicate sensitive information.  In this scenario, the latter group would naturally require greater levels of protection, as the impact of losing such a laptop would be higher.

As you can see in the list above, we have created subcategories in a couple of places as information can exist electronically, as well as on paper.  We also might want to categorise hardware and software technology separately.  As we mentioned earlier, you can begin to see that these asset types may suffer from the same types of impact, e.g., it doesn’t matter what the information is, if it is on paper then it all could be impacted by the threat of fire. Similarly, all suppliers need to be managed effectively and therefore we would want to guard against weaknesses in contracts etc.

These asset types can also be mapped to the ISO 27002 controls that provide protection against your information risks.  For example, software assets would benefit from controls such as vulnerability and patch management, and hardware assets from air conditioning and suitable power provision.  Your people assets would benefit from training and awareness processes, as well as from having suitable contracts of employment in place.

So, it is important to keep your goal in mind i.e., through risk assessment, to identify and then manage your risks in terms of confidentially, integrity and availability (CIA).  To do this, you need to achieve a manageable and actionable representation of risk for which you need a manageable asset list.

Do you need any help with ISO 27001 certificate?

URM can help you achieve ISO 27001 certification
Thumbnail of the Blog Illustration
Information Security
Published on
Asset identification within RA

A question which comes up time and time again is ‘How do I approach asset identification within my information security risk assessment’.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
Key Things You Should Know About ISO 27001

ISO 27001 is a standard for Information Security Management that provides any organisation with a framework to protect most valuable assets.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
Information Security Management Systems, ISO 27001 and the Benefits of Implementation

In this blog, we’re going back to basics and looking at some of the fundamentals of information security and ISO 27001.

Read more
Great webinar with lots of information. All easy to understand.
Webinar 'ISO 27001:2022 – What’s new?'
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.