Asset register for ISO 27001 (A.5.9) with example
An asset register is a list of all the information and business assets that matter for your information security, with an owner for each item. In ISO/IEC 27001:2022 , this is control A.5.9 “Inventory of information and other associated assets” in Annex A. The register is the starting point for your risk assessment: you can only protect what you know about.
“Asset” means business asset. That is broader than hardware. A customer database, a SaaS service (software delivered over the internet), a process, or the knowledge of a key employee can all be an asset. The NCSC (the Dutch National Cyber Security Centre) covers mapping your assets as a separate topic within asset management.
Short answer: for ISO 27001 A.5.9, you make an overview of your information and the systems, services and devices where that information is stored. Each item gets an owner and a classification. A spreadsheet is enough, as long as the register is up to date and matches your risk assessment.
What does A.5.9 require from an asset register?
ISO 27002:2022 elaborates on the control. The core: you create an inventory of information and related business assets, you keep it up to date, and you assign an owner to each item. The standard does not prescribe a format.
A.5.9 is the start of a small set of related controls:
| Control | Title (ISO/IEC 27001:2022) | What it adds to your register |
|---|---|---|
| A.5.9 | Inventory of information and other associated assets | The list itself, with owners |
| A.5.10 | Acceptable use of information and other associated assets | Rules for use, for example in a code of conduct |
| A.5.11 | Return of assets | Returning laptops and passes when someone leaves |
| A.5.12 | Classification of information | The classification per item |
| A.7.14 | Secure disposal or re-use of equipment | Safe disposal at the end of the lifecycle |
The owner is the person responsible for protecting the item. This is usually not an IT employee, but the manager who uses it. For example, the owner of the payroll administration is the head of HR.
Example asset register for ISO 27001
Below is a fictitious register for an installation company with 45 employees. It starts with information and links each item to where that information is stored. This shows you directly which systems you need to protect and why.
| ID | Asset | Type | Contains information | Owner | Classification | Location or supplier | Depends on |
|---|---|---|---|---|---|---|---|
| A-01 | Customer and project data | Information | Names, addresses, quotes, drawings | Commercial director | Confidential | CRM, SharePoint | A-10, A-11 |
| A-02 | Personnel files | Information | BSN (Dutch citizen service number), salary, sickness absence | HR manager | Highly confidential | HR package (SaaS) | A-12 |
| A-03 | Financial administration | Information | Invoices, bank details | Finance manager | Confidential | Accounting package (SaaS) | A-13 |
| A-04 | Work instructions and price lists | Information | Internal procedures | Head of administration | Internal | SharePoint | A-11 |
| A-10 | CRM system | Application | A-01 | Commercial director | Confidential | Supplier X, EU data centre | Internet, Entra ID |
| A-11 | Microsoft 365 | Cloud service | A-01, A-04 | IT manager | Confidential | Microsoft, EU region | Entra ID |
| A-12 | HR package | Cloud service | A-02 | HR manager | Highly confidential | Supplier Y | Entra ID |
| A-13 | Accounting package | Cloud service | A-03 | Finance manager | Confidential | Supplier Z | MFA via app |
| A-20 | Laptops (38 units) | Hardware | Temporarily A-01, A-04 | IT manager | Confidential | See MDM overview | Intune |
| A-21 | Fitter tablets (22 units) | Hardware | Work orders | Head of service | Internal | See MDM overview | Intune |
| A-30 | Planner’s knowledge | People | Scheduling logic, customer arrangements | Operations director | Internal | n/a | Replacement arranged |
Note two choices in this example. Laptops appear as a group in the register, with a reference to the management system for the serial numbers. And “planner’s knowledge” is included because losing one person would affect availability.
How detailed should an asset register be?
As detailed as your risk assessment requires, and no more. Putting every laptop with its serial number in your ISMS register is duplicate work if you have a mobile device management (MDM) system that already tracks this. In that case, refer to that system.
A good rule of thumb: group items with the same owner, the same classification and the same risk. Only split an item when it carries a different risk. For example, the finance director’s laptop with local exports belongs on its own line if that risk is greater.
Setting up an asset register in four steps
Start with the information
Ask each department which information they use and what happens if it leaks, changes or disappears. That gives you the first lines.
Link information to systems
For each type of information, note where it is stored: which application, which cloud service, which devices. Do not forget shadow IT, such as a free scheduling tool that one team uses on its own.
Assign owners and classifications
Each line gets an owner by name or function. Assign a classification according to your classification scheme.
Keep it up to date
Link the register to your processes: buying new software, joining and leaving the organisation, and disposing of equipment. Plan an annual review with all owners.
What does the auditor ask for as evidence for A.5.9?
During the ISO 27001 audit, the auditor mainly checks whether the register is complete and up to date. Expect these checks:
- Sample from practice. The auditor sees an application on a screen and looks it up in your register.
- Sample from the register. They pick a line and ask the owner what their role is.
- Link with the risk assessment. Do the most important assets appear in your risks?
- Last update. When was the register last updated, and does that match recent changes?
- Returning assets when leaving (A.5.11). An exit form that shows the laptop and pass have been returned.
A register that only contains hardware is the most common mistake. ISO 27001 starts with information. A list of laptops and servers says nothing about where your customer data is stored.
Common mistakes with an asset register
IT as owner of everything. IT manages systems, but does not decide how sensitive customer data is. Place ownership with the business unit.
SaaS services missing. Cloud services often hold your most important data. Include them and link them to your supplier management.
Made once and forgotten. A register that is eighteen months old misses new tools and lists departed employees as owners.
Too much detail. Five hundred lines that nobody maintains are worth less than forty lines that are correct.
Asset register and your Statement of Applicability
The register is the evidence for A.5.9 in your Statement of Applicability. It also appears in the list of records from Annex A on the mandatory documents page. Almost every organisation applies A.5.9. Excluding it is hard to justify.
Frequently asked questions about the asset register
Is a CMDB the same as an asset register?
Not quite. A CMDB (configuration management database) describes technical components and how they relate to each other. The ISO 27001 asset register starts with information and ownership. A CMDB can be a source for your register.
Which tool do I need for an asset register?
A spreadsheet is enough for most small and medium-sized organisations. An ISMS tool helps if you want to link the register to risks and controls.
More information
- Classifying information: filling in the classification column
- Risk assessment: from asset to risk
- Backup policy: deciding per system from the register what you back up
- Vulnerability management and patching: your register as the basis for patching
- Annex A: all 93 controls
- ISO 27002:2022 : the implementation guidance for A.5.9