Zum Hauptinhalt springen
CENEDRIL WIKI
DE
Starter Kit · Register

Asset Register

Updated on 2 min Reviewed by: Cenedril-Redaktion
A.5.9 ISO 27001BSI IT-Grundschutz

The asset register documents every information asset your organisation owns or relies on — from servers and applications to databases, business processes, and physical sites. Without this inventory, risk analysis has no foundation, because you can only protect what you know about.

ISO 27001 Control A.5.9 requires an up-to-date inventory of information assets with clear ownership. BSI IT-Grundschutz demands a comparable structural analysis as the first step toward determining protection requirements.

What does it contain?

The CSV template provides an audit-ready yet manageable asset inventory. Key columns:

  • Asset ID and name — unique identifier and a human-readable label
  • Category — hardware, software, data, process, personnel, site
  • Owner — named individual, with role and organisational unit
  • Classification — confidentiality, integrity, and availability on a defined scale (e.g. low / medium / high)
  • Location — where does the asset reside physically or logically?
  • Dependencies — which other assets or services depend on it?

How to use it

Initial population in a workshop. Invite representatives from IT, business departments, and senior management. Three hours are enough for the first version. Each person names the information assets in their area of responsibility, assigns a category, and estimates the protection requirement. The result is a working document with 30–80 entries (depending on organisation size).

Lifecycle maintenance. Tie the asset register to your change management process. Every new acquisition, decommission, or ownership change triggers an update. Once a year, review completeness during the management review — you will typically find orphaned entries whose owner left the organisation long ago.

Link to risk analysis. Every row in the asset register is assessed for threats and vulnerabilities during risk analysis. The cleaner the inventory, the more efficient the analysis. Gaps in the register mean blind spots in your risk landscape.

Register Template

Asset Register

.csv · EN.csv · DE
IDAsset NameTypeCategoryOwnerCustodianLocationClassificationCriticalityEnvironmentDescriptionStatus
AST-001Customer database (prod)InformationDatabaseHead of SalesIT OperationsAWS eu-central-1ConfidentialHighProductionPrimary customer record store (PostgreSQL 15)Active
AST-002Logistics portal (SaaS)ApplicationSaaSHead of OpsVendorVendor cloudConfidentialHighProductionCustomer-facing logistics tracking portalActive
AST-003M365 tenantServiceCloudISOIT OperationsMicrosoft cloud EUInternalHighProductionEmail collaboration and file storageActive
AST-004File server FS-01HardwareServerIT Operations LeadIT OperationsHQ Hamburg DCConfidentialHighProductionOn-prem SMB file shareActive
AST-005Domain controllers DC01 DC02HardwareServerIT Operations LeadIT OperationsHQ Hamburg DCConfidentialCriticalProductionActive Directory domain controllersActive
AST-006Laptops (fleet)HardwareEndpointIT Operations LeadIT OperationsDistributedInternalMediumProduction145 managed Windows + macOS laptopsActive
AST-007ERP systemApplicationOn-premCFOIT OperationsHQ Hamburg DCConfidentialHighProductionSAP Business OneActive
AST-008Backup system VeeamApplicationOn-premIT Operations LeadIT OperationsHQ Hamburg DC + offsiteConfidentialCriticalProductionCentral backup with offsite replicationActive
AST-009SIEM (Splunk)ApplicationOn-premISOIT OperationsHQ Hamburg DCConfidentialHighProductionLog aggregation and detectionActive
AST-010Firewall cluster FW-01/02HardwareNetworkIT Operations LeadIT OperationsHQ Hamburg DCConfidentialCriticalProductionPerimeter firewall HA pair (Fortinet)Active
AST-011VPN gatewayHardwareNetworkIT Operations LeadIT OperationsHQ Hamburg DCConfidentialHighProductionRemote access gatewayActive
AST-012S3 bucket nwl-marketingInformationCloud storageMarketing LeadIT OperationsAWS eu-central-1InternalMediumProductionMarketing assets (public-read disabled)Active
AST-013CI/CD pipeline (GitLab)ApplicationOn-premHead of EngineeringIT OperationsHQ Hamburg DCConfidentialHighProductionSource control and build pipelineActive
AST-014Mobile phones (fleet)HardwareEndpointIT Operations LeadIT OperationsDistributedInternalMediumProduction38 managed iOS devicesActive
AST-015HR database (Personio)InformationSaaSHR LeadVendorPersonio EUConfidentialHighProductionEmployee master dataActive
AST-016Physical HQ buildingFacilityBuildingFacilities LeadFacilitiesHamburgInternalHighProductionMain office 1200 sqm + server roomActive
AST-017Payroll dataInformationFileHR LeadHRPersonio + local archiveStrictly ConfidentialHighProductionMonthly payroll recordsActive
AST-018Contract archiveInformationFileLegalLegalM365 SharePointConfidentialMediumProductionSigned contractsActive

Sources

ISO 27001 Controls Covered

A.5.9 Inventory of information and other associated assets

Frequently asked questions

What counts as an information asset?

Anything that holds value for your organisation and needs protection: servers, applications, databases, but also business processes, premises, and third-party services. ISO 27001 distinguishes primary assets (information and processes) from supporting assets (hardware, software, network, personnel, sites).

How granular should the register be?

Granular enough so that each row can be assigned a clear protection requirement and an accountable owner. 'All laptops' is too coarse if different departments process different data on them. One row per serial number is usually too fine. The right level is wherever risks can be meaningfully assessed.

How often do I need to update the asset register?

Whenever a material change occurs — new systems, decommissions, relocations, ownership changes — and at least once a year during the ISMS management review. Many organisations tie updates to the change management process so new assets are captured automatically.