Skip to main content
All measures

Measure · ISO 27001 and other standards

Build and maintain an information and asset inventory

Keep information and its supporting assets in identifiable records with clear owners. Reuse suitable inventories and add only what is missing.

Accountable: Information and asset owners with IT and inventory administrationReviewed

Reuse existing records

Keep using suitable information, device, application and service inventories. The template adds missing entries and connects them through stable references. Information classes and handling rules stay in the information protection policy.

What to do

  1. 1

    Reconcile existing inventories

    Determine the inventory needed for your ISMS scope. Review existing data, application, device and service registers with their owners. Include information without personal data, such as source code, designs and operational knowledge. Reuse suitable registers and identify their authoritative locations. Add missing entries to the appropriate inventory instead of maintaining a second list of the same content.

  2. 2

    Connect information, assets and ownership

    Assign an owner to each relevant entry. Connect information to the applications, services, devices or other assets used for it. Use stable IDs or unambiguous entry references that survive sorting. Make applicable protection requirements accessible through the information entry or an existing classification reference. Groups are useful when ownership, protection needs and relevant components remain clear.

  3. 3

    Keep up with operational changes

    Connect inventory maintenance to procurement, commissioning, changes and retirement. Reassign ownership when the responsible person changes role or leaves. Reconcile the inventory with actual information and assets at suitable intervals. Resolve missing or conflicting entries with the owners. Record the review result and necessary corrections in the existing inventory or request.

  4. 4

    Maintain a traceable file version

    Keep the authoritative file in a shared location with appropriate access controls and clear responsibility. Use its existing version history. If none is available, retain traceable versions such as V1, V2 and V3 and record significant changes with dates and owners. Avoid parallel working copies. Retain historical entries and relationships where needed for later traceability.

Worked example

A new Git service is missing from the inventory

Development moves its source code to a new Git service. The device inventory lists the laptops, and the information inventory lists the source code. The new service and its owner are missing.

Source code, Git service and development devices
DecisionThe owners retain the authoritative source-code entry, add the new service with its responsible role and connect it to the information asset and existing device inventory. During the move they check which relationships to the old service are still needed.
EvidenceUpdated inventories and relationships. The existing change request records the verified state and remaining work.

Record the result

  • Authoritative inventories with information, supporting assets, owners and accessible protection requirements.
  • Recorded changes, checked relationships and relevant earlier versions in the existing file or system history.

Common implementation mistakes

Several copies are maintained independently

Decide which inventory owns each field. Connect existing entries through stable references so separate files do not show conflicting owners or system states.

A group hides relevant differences

Group similar assets only when ownership, protection requirements and relevant components remain clear. Separate entries where grouping would obscure different owners or protection requirements.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.5.9 · Inventarisierung von Informationen und zugehörigen VermögenswertenGerman guide

    The workflow connects inventory creation, ownership, relationships and ongoing maintenance of information and supporting assets. The template records missing entries and references suitable existing inventories. The organisation determines its actual scope and performs the work.

  • TISAX · 1.3.1

    VDA ISA 6.0.3 · Partial overlap

    A connected information and asset inventory with owners, accessible protection requirements and maintained changes supports an overview of relevant information and supporting assets. Further ISA requirements, protection decisions and actual implementation remain separate work.

    Reference

Templates for your implementation

Related resources

Sources and further reading