Have you ever wondered what exactly ‘asset management’ means in the context of information security management systems? You’re not alone. ISO 27001 Annex A.8 covers asset management, but for many, the specific definitions and requirements in this annex can be confusing.
Annex A.8 of the ISO 27001 standard focuses on properly managing your organization’s assets. An “asset” refers to anything that has value to your company like hardware, software, data, and employees. By identifying and categorizing all your assets, you can determine the best ways to protect them.
To get started with asset management, you’ll need to identify all the important assets in your organization. This could include things like:
Once you have a full list of assets, categorize them by importance and sensitivity. This helps you prioritize security controls and protection methods. You’ll want to focus the most effort on your critical assets.
An effective asset management program also involves keeping detailed records of all assets, including their owners, values, locations, configurations, and any vulnerabilities. Regularly review and update these records to keep them current.
Knowing what needs protection and continuously monitoring assets allows you to implement controls tailored to your organization’s needs. While it requires effort to establish, a comprehensive asset management program will give you peace of mind that your valuable resources are secure.
To properly manage your assets under ISO 27001, there are a few key controls you’ll want to put in place.
First, establish an asset register to maintain information about all your important IT assets. This should include details like asset owner, value, security classification, and location. Review and update it regularly.
Next, classify your assets based on their importance to your organization. Things like servers, customer databases, and financial systems would likely be classified as high-value assets requiring strong security controls.
You’ll also want to assign ownership and responsibilities for each asset. The asset owner is responsible for classifying the asset, determining appropriate controls, and ensuring those controls are implemented.
Another critical control is maintaining adequate protection of your assets based on their classification. This could include physical security controls like locked server rooms for high-value assets or access controls like multi-factor authentication for sensitive data.
Finally, plan for how you will handle assets at the end of their lifecycle through activities like data sanitization, hardware disposal, or software deinstallation. This helps prevent unwanted access to assets that are no longer in active use.
By establishing an asset register, classifying your assets, assigning ownership, implementing appropriate safeguards, and planning for asset disposal, you’ll have a solid asset management program aligned with ISO 27001. Keeping your assets secure and your data protected will give you peace of mind and help ensure business continuity.
Developing an effective asset management policy and maintaining an up-to-date inventory of your organization’s assets are crucial first steps to implementing ISO 27001.
An asset management policy establishes the rules and procedures for how your organization’s assets should be properly handled and safeguarded. Work with key stakeholders from IT, security, and department heads to draft a comprehensive policy that covers.
Conducting a thorough inventory of your digital and physical assets provides a complete overview of what needs to be protected under ISO 27001. The inventory should include attributes like:
By developing a comprehensive policy and asset inventory, you’ll have a solid foundation in place to build your ISO 27001 information security management system. Be sure to review and update these documents regularly to account for changes to your organization’s assets and risks over time. By now you should have a solid understanding of what assets are, how to identify and classify them, and best practices for managing and protecting them. Implementing effective asset management controls and procedures is crucial for any organization that wants to achieve and maintain ISO 27001 certification.
