You cannot protect what you do not know you have. That is why ISO 27001 asset management is one of the first things an auditor checks. It covers finding your information and the systems that hold it, assigning owners, classifying data and handling media safely.
In the 2013 edition, these topics lived in Annex A.8. The 2022 edition split them across organizational controls 5.9 to 5.13 and physical control 7.10. This guide explains each one with practical examples.
Free tool: How ready is your organization? Take our ISO 27001 self-assessment: 30 questions on clauses 4–10 and Annex A.
Mapping: A.8 (2013) to ISO 27001:2022
| ISO 27001:2013 | ISO 27001:2022 |
|---|---|
| A.8.1.1 Inventory of assets, A.8.1.2 Ownership of assets | 5.9 Inventory of information and other associated assets |
| A.8.1.3 Acceptable use, A.8.2.3 Handling of assets | 5.10 Acceptable use of information and other associated assets |
| A.8.1.4 Return of assets | 5.11 Return of assets |
| A.8.2.1 Classification of information | 5.12 Classification of information |
| A.8.2.2 Labelling of information | 5.13 Labelling of information |
| A.8.3.1 to A.8.3.3 Media handling | 7.10 Storage media |
5.9 Inventory of information and other associated assets
First, build an inventory. In 2022, the focus shifted from “assets” in general to information and the assets that store or process it. So a good inventory includes:
- information assets: customer data, contracts, source code, financial records;
- software and cloud services: SaaS apps, databases, code repositories;
- hardware: servers, laptops, phones, network devices;
- people and suppliers who handle key information.
Every entry needs an owner, someone accountable for its protection. In addition, record its location, classification and importance.
Keep the inventory current. For example, connect it to procurement, HR onboarding and cloud account tooling, rather than updating a spreadsheet once a year.
5.10 Acceptable use
Next, write clear rules for using information and devices. An acceptable use policy usually covers:
- personal use of company devices and email;
- installing software;
- using generative AI tools with company data;
- storing files on personal cloud accounts;
- handling information by classification level.
Staff should read and accept these rules, often during onboarding.
5.11 Return of assets
When people leave or change roles, they must return laptops, phones, tokens, access cards and documents. Importantly, this includes information on personal devices. So link the process to HR’s leaver checklist, and keep signed return records.
5.12 Classification of information
Then classify information by how much harm its disclosure, change or loss would cause. Most organizations use three or four levels:
| Level | Example | Handling |
|---|---|---|
| Public | Marketing pages, published prices | No restrictions |
| Internal | Policies, internal emails | Staff only |
| Confidential | Customer data, contracts | Need-to-know, encryption |
| Restricted | Payment data, credentials, M&A plans | Named people, strict controls |
Keep the scheme simple. If staff cannot remember it, they will not use it.
5.13 Labelling of information
Labels make classification visible. For example, use document headers and footers, email tags, file metadata or sensitivity labels in Microsoft 365. Automated labels reduce mistakes. However, some information, such as public web content, may not need labels at all.
7.10 Storage media
Finally, protect removable and fixed storage media throughout their life:
- restrict or block USB storage where it is not needed;
- encrypt removable media that hold confidential data;
- track media sent outside the organization;
- securely wipe or destroy media before disposal or reuse.
New 2022 controls that support asset management
The 2022 edition added related controls:
- 8.10 Information deletion: delete data when you no longer need it, including in cloud services.
- 8.11 Data masking: hide sensitive fields, for example in test environments.
- 8.12 Data leakage prevention: detect and block unauthorized data transfers.
What auditors check
- An inventory with owners, which matches what they see on site.
- A classification scheme and real examples of labelled documents.
- Acceptable use acknowledgements from staff.
- Return-of-asset records for recent leavers.
- Records of secure media disposal, such as destruction certificates.
FAQ
Do we need an asset management tool?
Not necessarily. A well-maintained spreadsheet is fine for small firms. Larger firms, however, benefit from CMDB or endpoint management tools.
Are people assets in ISO 27001?
The 2022 control focuses on information and the assets that hold or process it. Even so, many organizations also record key people and roles, because their knowledge can be critical.
Related guides
- ISO 27001:2022 Annex A: all 93 controls and the 2013 mapping
- Free ISO 27001:2022 readiness checklist
- What is an ISMS? Concept, benefits and the PDCA cycle
Sources
- ISO/IEC 27001:2022, Information security management systems (ISO)
- ISO/IEC 27002:2022, Information security controls (ISO)
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. Doing it yourself? The ISO 27001:2022 Starter Kit (₹1,999) gives you the gap workbook, risk register, Statement of Applicability and 13 policy templates. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
