How do you Categorise Your Assets When Conducting an Information Security Risk Assessment?

Latest update:
19 Jul
2022

‘How do we approach asset identification within our information security risk assessment?’.   There are 2 aspects to this question; ‘which assets do we include?’ and ‘how granular do we make the list?’.  This blog examines which assets or asset types to include and should be read in conjunction with another URM blog titled ‘How do I Approach Asset Identification Within My Information Security Risk Assessment?, where we stressed the need to stay at a high level when identifying your information assets.

One thing that we recommend you think about is categorising your assets.  This is a useful process as it enables you to identify assets that could face similar threats or may contain similar vulnerabilities.

The following list is typical, but is by no means the only way to categorise your assets, as it depends on the nature of your business.  As such, this is not an exhaustive list, but is a good starting point which, in our experience, addresses the majority of asset types:

  • Information
    –  Electronic
    –  Paper
  • People
  • Premises
  • Suppliers
  • Equipment
  • Technology
    –  Hardware
    –  Software
  • Equipment (non-technology equipment such as a fire safe)
  • Intangibles (such as brand and reputation)

The first thing to note is that ‘information’ is at the top of the list.  This should always be your first consideration as this is the focal point of what you are trying to protect.  All of the other types are known as supporting assets because they help you to store, communicate or process the information.  As such, they tend to inherit the value of the information itself. For example, we may split laptops out into two groups; a general one for all employees and one for those who store, process or communicate sensitive information.  In this scenario, the latter group would naturally require greater levels of protection, as the impact of losing such a laptop would be higher.

As you can see in the list above, we have created subcategories in a couple of places as information can exist electronically, as well as on paper.  We also might want to categorise hardware and software technology separately.  As we mentioned earlier, you can begin to see that these asset types may suffer from the same types of impact, e.g., it doesn’t matter what the information is, if it is on paper then it all could be impacted by the threat of fire. Similarly, all suppliers need to be managed effectively and therefore we would want to guard against weaknesses in contracts etc.

These asset types can also be mapped to the ISO 27002 controls that provide protection against your information risks.  For example, software assets would benefit from controls such as vulnerability and patch management, and hardware assets from air conditioning and suitable power provision.  Your people assets would benefit from training and awareness processes, as well as from having suitable contracts of employment in place.

So, it is important to keep your goal in mind i.e., through risk assessment, to identify and then manage your risks in terms of confidentially, integrity and availability (CIA).  To do this, you need to achieve a manageable and actionable representation of risk for which you need a manageable asset list.

Thumbnail of the Blog Illustration
Information Security
updateD:
9/8/2022
What is the Difference Between IT and Information Governance?

In this blog, we are going to look at governance. We are regularly asked, ‘what do you mean by governance?’ or, ‘is information governance the same as IT governance?’

Read more
Thumbnail of the Blog Illustration
Information Security
updateD:
11/8/2022
What’s the Difference Between a Certified and a Compliant ISO 27001 Information Security Management System?

There is some confusion about the difference between having an information security management system (ISMS) which is certified to ISO 27001 and one which is compliant or aligned to the Standard.

Read more
Thumbnail of the Blog Illustration
Information Security
updateD:
21/7/2022
How Do You Implement a Successful ISMS?

The first and primary myth to dispel is that executing your decision to use an information security management system (ISMS) to manage the security of your information assets is a project. It is not.

Read more
"
Great presentation - looking forward to your future events.
Webinar 'ISO 27001 Internal Auditing, the 6 Pillars of Success'
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.