Inventory of information and other associated assets

Plain-language summary

Knowing what information you hold and which assets support it — systems, software, devices, services, facilities — with a named owner for each, recorded in an inventory accurate enough to base risk, access and protection decisions on.

What the clause is really asking

You cannot protect what you do not know you have. This control asks you to keep an up-to-date inventory of your information and the assets associated with it, with an owner named for each. Information comes first deliberately: customer records, designs, HR files, financial data and the datasets inside systems, not only the hardware they run on. Associated assets include software, services, devices, network equipment, facilities and storage media. The inventory need not be a single list — an IT asset tool, a cloud register and an information asset register can work together — but they must agree with each other and with reality. Owners answer for their assets across the life cycle: classification, protection, access review and proper disposal. The common misunderstanding is that the IT hardware list is the inventory. In South Africa, include personal information: the categories of data subjects and personal information described in your PAIA section 51 manual should reconcile with the register, and POPIA section 19's duty to identify foreseeable risks to personal information starts here.

What auditors look for

Auditors ask for the inventory and test it in both directions. From the register, they pick assets and ask to see them or their owner — a laptop serial number, a database, a cloud service. From the floor, they note a server, a shared drive, a SaaS tool someone mentions or a cabinet of HR files and check it is listed. They ask owners what their responsibilities are. They compare the information assets with the PAIA manual. They check the inventory feeds risk assessment and access reviews. The hard question: when was this last updated, and what process updates it when something new arrives or leaves?

Typical evidence

Information asset register listing information types, location, classification, owner and personal information categories; IT asset inventory of hardware and software; cloud service register; owner assignments and acknowledgements; update procedure linked to procurement, onboarding and disposal; reconciliation records between inventories; PAIA section 51 manual cross-referenced to the register.

How to comply — recommendations

Start with information, not hardware: run short workshops with each department to list the information they hold, where it lives, who owns it and whether it includes personal information. Record it in an information asset register with classification and owner. Link it to the IT asset inventory, ideally generated automatically by your endpoint or device-management tool, and to the cloud service register. Tie updates to procurement, onboarding, change management and disposal so the inventory changes when the estate does. Have owners confirm their entries every year. Reconcile the personal information entries with your PAIA manual and use the register as the starting point for risk assessment.

Common nonconformities

Inventory limited to IT hardware with no information assets; assets in use but not listed, such as cloud services or shared drives; owners not assigned or unaware of their role; inventory out of date; disposed assets still listed; no process for keeping the inventory current; personal information holdings not identified; separate inventories that contradict each other.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.