ISO 27001 A.5.9: Inventory of information and other associated assets

Define what counts as an information asset in your organisation and set up a classification scheme. Information assets include databases, data files, contracts, documentation, research, training materials, and operational procedures. Associated assets include hardware, software, network resources, cloud services, and the people and processes around them.

Pick an asset management tool that fits your size. A spreadsheet works for small organisations; larger ones will need a dedicated ITAM tool or CMDB. At minimum, capture: asset identifier, name, type, description, owner, custodian, location, classification, and status.

Run an initial discovery exercise. Use automated tools for IT assets - network scanners, software inventory tools, cloud asset discovery. Then go manual for the non-IT assets: physical records, intellectual property, process documentation. Get business units involved to identify the information assets they own.

Assign an owner to every single asset. The owner is accountable for the asset's lifecycle, classification, access requirements, and eventual disposal. Make sure owners actually understand what that means. Distinguish between the owner (accountable) and the custodian (handles day-to-day management).

Build maintenance into your processes. Integrate asset registration into procurement and provisioning so new assets are recorded automatically. Run quarterly reconciliation for critical assets and annual for everything else. Have a decommissioning procedure that includes removal from the inventory - stale entries are almost as bad as missing ones.