ISO 27001 Control A.5.9: Inventory of Information and Other Associated Assets

You cannot protect what you do not know you have. It is one of the oldest ideas in security and it is the reason an asset inventory sits near the front of almost every ISO 27001 implementation. Before you can say which risks matter, which controls apply or who should be told when something breaks, you need an honest list of the things that carry value: the information itself, the systems that hold it, the people and places that handle it. A.5.9 is the ninth of 37 organizational controls in Annex A.

Done badly, an inventory is a spreadsheet exported once for the audit and never touched again. Done well, it is a living register that answers practical questions fast. Which systems hold customer data? Who owns the finance platform? Which laptops are we responsible for? What do we need to restore first?

What the control requires

Annex A control 5.9 of ISO 27001:2022 states that an inventory of information and other associated assets, including owners, shall be developed and maintained.

The key elements:

Information and other associated assets - the information itself, plus what stores, processes or carries it: hardware, software, services, facilities, and sometimes people and reputation
Inventory - a list that identifies each asset clearly enough to be found and managed
Including owners - every asset has a named accountable person or role
Developed and maintained - created once, then kept accurate as things change

A.5.9 is a preventive control in ISO/IEC 27002:2022. It prevents unmanaged assets from lurking outside your controls. Annex A states the control; ISO 27002 gives guidance, including that the inventory should be accurate, up to date, consistent and aligned with other inventories, and that each asset should be classified in line with the classification of the information it holds. Note that “associated assets” in the 2022 version is broader than the “assets” of earlier editions, and explicitly treats information as the thing being protected.

How to implement an inventory of assets

Decide what counts and how detailed to be

Begin by choosing categories that make sense for your business. Common ones are:

Information - customer data, contracts, financial records, source code, employee files, research
Applications and services - business systems, cloud platforms, SaaS tools, internal tools
Hardware - laptops, phones, servers, network equipment, removable media
Facilities - offices, server rooms, storage areas, as discussed in securing offices, rooms and facilities
Suppliers and external services - the third parties that hold or process your information

Be pragmatic about granularity. Inventorying every cable or every license key is rarely useful. Group similar items, such as “company laptops”, while tracking individual items where they matter, for instance where loss or theft would trigger a response. The aim is to support decisions, not to produce the longest list.

Many organizations find it easiest to start from information: list the main types of information the business depends on, then work outward to the systems, locations and suppliers involved with each. This keeps the inventory tied to value instead of becoming an equipment catalogue.

Record what you need to manage each asset

A useful record usually holds a small number of fields:

A unique name or identifier
A short description and the type of asset
The owner, and where relevant a custodian who looks after it day to day
Location, whether physical or logical, including cloud region where relevant
The classification or sensitivity of the information involved
Links to dependencies, such as which services rely on it
Lifecycle status, from in use to retired

Resist adding columns that nobody will maintain. A short table that stays accurate beats a rich one that rots.

Assign real owners

The owner is the person with accountability for the asset throughout its lifecycle, not necessarily the person who uses it every day or the IT administrator. A head of finance owns finance data; IT may operate the system that stores it. Owners decide who should have access, how the asset is classified and when it should be retired. This ties directly to segregation of duties and to the roles set out in information security roles and responsibilities. If an asset has no owner, nobody is answering for it, and that is exactly the gap this control is meant to close.

Keep it accurate

Maintenance is where most inventories fail. Build updates into events that already happen:

When a person joins or leaves, devices and accounts are added or reconciled
When a system is procured, changed or switched off, the register changes with it
When equipment is moved, repaired or taken home, as covered in security of assets off-premises, the location is updated
When equipment is retired, the record is closed after secure disposal or re-use of equipment

Where possible, source parts of the inventory automatically, from your device management tool, cloud account listings or identity provider, and reconcile them against the manual register. A quarterly review in which owners confirm their entries is a light but effective routine. It also helps to look for shadow IT, the tools that teams adopted without telling anyone, because they will not be in any list until someone asks.

Use the inventory

An inventory earns its keep when other processes depend on it. Use it as the starting point for your information security risk assessment, for your scope and statement of applicability, for business continuity priorities, and for supplier reviews. If your risk assessment names assets that are not in the inventory, one of them is wrong.

A.5.2 connection. Information security roles and responsibilities is where asset ownership responsibilities are defined.

A.5.3 connection. Segregation of duties shapes who may own, operate and review sensitive assets.

A.7.9 connection. Security of assets off-premises depends on knowing which assets leave the building.

A.7.10 connection. Storage media covers a category of asset that is easy to lose track of.

A.7.14 connection. Secure disposal or re-use of equipment closes the lifecycle that the inventory records.

Clause 4.3 connection. Determining the scope of the information security management system draws on knowing what assets and locations are in play.

Clause 8.2 connection. Information security risk assessment identifies risks to the assets listed here.

Forward reference. Acceptable use of assets, return of assets, classification and labelling of information, which follow in the series, all build on this inventory.

What auditors check

Existence and coverage. Auditors ask to see the inventory and test whether it covers the main categories: information, systems, devices, facilities and suppliers.

Named owners. They look for an owner against every entry and may call a few of them to check they know they own it.

Accuracy by sampling. A typical test is to pick a few devices or systems in the office or console and find them in the inventory, then pick entries and find the asset.

Currency. Review dates, change history and the handling of leavers and retired equipment indicate whether the register is maintained.

Consistency. The list should match what your risk assessment, scope and supplier register say.

Classification link. Auditors may check that assets carry a classification consistent with your scheme.

Common mistakes to avoid

A one-off export. An inventory created for the audit and never updated is stale within weeks.

Hardware only. Information, SaaS tools and suppliers are often the most valuable assets and the most commonly missing.

No owners, or the wrong ones. “IT” as owner of everything means nobody makes decisions about business information.

Too much detail. Tracking every item at maximum granularity creates a maintenance burden that guarantees decay.

Ignoring shadow IT. Tools bought on a credit card by a team are still assets holding your information.

Disconnected registers. Separate lists for IT, HR, facilities and finance that disagree with one another make audits and incidents harder.

How 27kay can help

We help organizations build inventories that are proportionate and genuinely used, starting from information and risk rather than from a long equipment list. As part of ISO 27001 implementation, we set up the register, agree owners, connect it to your tooling where possible and align it with risk assessment and scope. For the full picture, see our ISO 27001 knowledge hub.

If someone asked you today where your most sensitive information lives and who owns it, how quickly could you answer? Get in touch - we will help you make that a one-minute question.