ISO 27001 Annex A control 5.9 requires an inventory of information and other associated assets with their owners; 5.10 covers acceptable use and 5.11 the return of assets. The inventory is also the starting point for the risk assessment, because a risk is assessed against the assets it could affect.
Inventories kept by hand drift within weeks; pulling them from cloud, device management and identity systems keeps them current. See information classification.
Read more
Related terms
- Information classification
- Information classification is the scheme that labels information by sensitivity and value, so that handling, access and protection rules can follow the label.
- Risk treatment plan
- A risk treatment plan is the ISO 27001 document recording how each information security risk will be treated, by whom, by when and with which controls.
- Annex A
- Annex A of ISO/IEC 27001:2022 is the reference list of 93 information security controls, grouped into organizational, people, physical and technological themes.
- Continuous compliance
- Continuous compliance is keeping controls in a known, evidenced state between audits instead of reconstructing that state before each one.