How Do You Meet the Asset Management Requirements of IS0 27001?

19 Jul

In order to meet the requirements of ‘Asset management’ A.8 from Annex A of ISO 27001, it is necessary to identify organisational assets and define appropriate protection responsibilities, as well as ensuring that information receives an appropriate level of protection in accordance with its importance to the organisation.

Establishing Asset Registers

When compiling your asset registers or inventories, it is recommended that you record the following information for each information asset:

  • Asset type
  • Asset owner
  • Asset classification
  • Asset location
  • Asset impact levels in relation to confidentiality, integrity and availability

Establishing Asset Types

URM suggests the following basic segregation of assets:

  • Information assets
  • Supporting assets
    –  hardware
    –  software
    –  people
    –  buildings
  • Intangible assets (e.g., brand and reputation).

Identifying Asset Owners

In the process of identifying asset owners, it is important to identify a functional role that has oversight of specific types of assets.  

Asset owners are responsible for:

  • Identifying risks to the asset type
  • Providing guidance and instructions on how the asset should be used.
  • Identifying levels of protection required depending on the asset classification.
  • Implementing and verifying the effectiveness of security controls in respect of that asset type.

Assigning Asset Classifications

Depending on the organisational structure, it would typically be the asset owner who would decide asset classification.  The classification must be approved by top management and the criteria for protection of assets must be in line with their criticality.

Assigning Impact Levels

As with classification, impact levels need to be assigned by the asset owner.  Determining the impact levels of assets can be relatively complex, but in essence, the impact level will be inherited by the information contained on or within the asset.

Read more

Do you need any help with ISO 27001 certificate?

URM can help you achieve ISO 27001 certification
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Thumbnail of the Blog Illustration
Information Security
Published on
The New Threat Intelligence Requirements in ISO 27001:2022

URM’s blog discusses the changes to the requirements around threat intelligence in ISO 27001:2022 and what certified organisations will need to do differently.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
Asset identification within RA

A question which comes up time and time again is ‘How do I approach asset identification within my information security risk assessment’.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
How do You Develop and Implement an Incident Management Plan?

Due to the increased use of technologies and the ‘human’ involvement, it is inevitable we are all going to face more and more information security incidents.

Read more
Great presentation - looking forward to your future events.
Webinar 'ISO 27001 Internal Auditing, the 6 Pillars of Success'
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.