Key takeaways
- Keep a list of your information and the assets that hold it, each with an owner.
- You cannot protect what you do not know you have.
- Start here: decide what counts as an asset: hardware, software, cloud services, data sets, key people.
Purpose
Keep a list of your information and the assets that hold it, each with an owner.
Requirement
Requirement summaryAn inventory of information and other associated assets, including owners, shall be developed and maintained.
Why it matters
You cannot protect what you do not know you have. An asset inventory underpins risk assessment, access control and incident response.
How to implement
- Decide what counts as an asset: hardware, software, cloud services, data sets, key people.
- Build an inventory with owner, location, classification and status for each item.
- Automate discovery where possible (device management, cloud inventories).
- Review and reconcile the inventory at a set frequency and when assets change.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.9. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your asset management policy.
- Your asset inventory: a list of your information, devices, software and services, each with an owner.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.9 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Proof the inventory was reviewed and updated recently.
- Evidence that new assets are added and old ones removed, such as recent entries for new laptops and disposed equipment.
- A spot check showing items on the list really exist, and items in use are on the list.
Things you should be able to show or explain
- Be able to show how a new device or system gets added to the inventory.
How much to show: 10 to 15 items, checked both ways (list to reality, reality to list).
Common mistakes
- Assets in use that are missing from the inventory.
- Owners listed who have left.
- An inventory that covers laptops but ignores cloud services and data.
- Assets with no named owner.
- Tip: A well-maintained spreadsheet is fine to begin with.
Policies & documents to have
- Asset Management Policy
FAQ
Is A.5.9 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.9?
Be ready to explain how the control works in your organisation and to provide things like: Your asset management policy…